Trickbot malware has targeted organizations across industries for a number of years, with activity spanning cyberattacks on the healthcare sector in 2020 to malicious activity today, according to the Cybersecurity and Infrastructure Security Agency (CISA).

In the latest Cybersecurity & Geopolitical Podcast episode presented by Security magazine, Cyjax CISO Ian Thornton-Trump and Grey Hare Media CEO Philip Ingram, MBE, are joined by Cyjax Cyber Threat Intelligence Analyst Joe Wrieden, author of a report analyzing leaked information to determine how the Trickbot malware group operates. The trio discusses what they dub "cybercrime 2.0" and contextualizes the Trickbot leaks within the ongoing Russian invasion of Ukraine.

You can listen to the audio version right here below!

You can also listen on the go anytime via our Spotify and Apple podcast channels: The Security Podcasts.

 Watch the video version here or on our LinkedIn and YouTube channels.

This month, the Cybersecurity & Geopolitical Podcast focuses on a new report on the recent Trickbot leaks that opens the lid on the workings of Russian cybercrime through an exclusive interview with its author, Joe Wrieden. Thornton-Trump, Ingram and Wrieden contextualize the leaks within the Russian invasion of Ukraine, assessing cyberattack trends and their geopolitical effects.

Since the start of the Russia-Ukraine conflict, Russian-based cybercrime groups have been placed in a difficult position. With many groups comprising a variety of nationalities, the various members have had to determine their political allegiance. Leading the charge was the Conti ransomware group, detailing its full support for the Russian government in a post on February 25, 2022. This came just one day after the invasion of Ukraine.

Thornton-Trump, Ingram and Wrieden discuss how this post caused shockwaves in both the intelligence community and within Conti itself. On February 27, a Twitter account named @ContiLeaks began posting links to the logs of internal communications by the group. Within hours, threat intelligence researchers around the world were beginning to conduct analysis into the dump, which contained over 60,000 messages. This leak caused significant unrest within the group.

A week later, a newly created account named @trickleaks began posting tweets that appeared to contain links to internal communications from members of the Trickbot group. These leaks were posted increasingly quickly, as 35 believed members’ messages were uploaded over a two-month period. This led to a total of over 1,000 communication extracts.

Each file consists of a direct communication or a group chat involving the user, which range in size. Some files contain nearly 10,000 messages. In total, there are approximately 250,000 messages, which contain over 2,500 IP addresses, around 500 potential crypto wallet addresses, and thousands of domains and email addresses.

This leak was like nothing seen before and gave cyber threat intelligence researchers unprecedented access to the Trickbot organization. Alongside these messages, PDF files were leaked which contained large amounts of information reportedly about individual members. This included full names, addresses and identification numbers. These “Doxing PDF” files enable the analysis the people behind the usernames, examining how and why they are working for the criminal organization.

For more insights into the Trickbot leaks, listen to or watch the Cybersecurity & Geopolitical Podcast episode with Thornton-Trump, Ingram and Wrieden.