What is TrickBot Malware?

TrickBot Malware

malware OpenTrojan Threat Intelligence Updated 2026-08-26

Banking credentials; enterprise network reconnaissance

Source Attribution

Origin: MITRE
Source: MITRE ATT&CK · CISA
Reviewer: Phase 44E review
Verified: 2026-08-26T15:16:26.825Z
Confidence: high

Source: MITRE ATT&CK · CISA · Verified: 2026-08-26T15:16:26.825Z · Confidence: high

Security Timeline

2016-10 discovered TrickBot banking trojan first observed
2020-10 updated CISA alert AA20-287A published

Quick Answer

TrickBot payloads include credential dumping, mail exfiltration, VNC and module updates, frequently paired with Ryuk/Conti ransomware deployment.

Definition

TrickBot is a modular banking trojan that performs credential theft, acts as a loader for ransomware, and supports network reconnaissance in enterprise environments.

Overview

TrickBot is a modular banking trojan that performs credential theft, acts as a loader for ransomware, and supports network reconnaissance in enterprise environments.

Behavior

Credential theft modules
Loader for ransomware operations
Network mapping capability

First Seen

2016-10

Target

Banking credentials; enterprise network reconnaissance

Techniques: T1003, T1110, T1566
Campaigns: n/a
Related CVEs: CVE-2020-1472

Malware Intelligence

Family: TrickBot Malware

Aliases: TrickBot, TrickLoader

Techniques: T1003, T1110, T1566

Targets: Banking credentials; enterprise network reconnaissance

Behavior:

Credential theft modules
Loader for ransomware operations
Network mapping capability

References

Have a follow-up question?

Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.

Ask AI about this Start an investigation

Start Investigation

Move from reading to investigating TrickBot Malware. The workspace is a structured analysis surface — not a chat — organised as:

Question — what do you need to know about TrickBot Malware?

Evidence — assertions mapped to verifiable references.

Timeline — events in chronological order.

Related Entities — CVE, threat actor, campaign, malware links.

Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.

Notes — your own observations and working hypotheses.

AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.