Trickbot Malware Went Into Hiding And Now It’s Back
By Eric Buhrendorf ·
Updated October 2026: We added what happened to Emotet and Trickbot after their 2020 comeback, including law enforcement takedowns and the unmasking of the group’s suspected leader, plus current steps to protect your network.
Trickbot Malware Went Into Hiding And Now It’s Back
For more than five months, the internet breathed a collective sigh of relief as one of the most notorious strains of malware, Emotet, went dark and ceased all activity. It was as though the hackers in control of the code had simply pulled the plug. All good things, however, inevitably end. On July 17, 2020, Emotet came roaring back to life and began spamming out vast numbers of emails in what is apparently a new campaign.
The malware relies on the tried and true tactic of sending emails with poisoned files that are disguised as payment reports, shipping details, employment opportunities, and the like. Of course, that’s just the cover. If an unwitting recipient opens these corrupted files, instead of gaining access to the promised information, they’ll unknowingly install another dreaded malware strain, Trickbot.
Trickbot is a nasty piece of work, capable of spreading laterally throughout a network, compromising an increasing number of machines. On every machine it infects, it will look for and harvest login credentials and cookies from browsers. They pay particular attention to banking credentials, but happily harvest anything else as well.
In addition to that, it will steal OpenSSH keys and Active Directory Services databases and the like. Worst of all, once it has stolen everything it finds of interest, it opens a reverse shell on the network, giving access to groups in control of the Conti and Ryuk ransomware strains. This second group of hackers will gleefully descend on the now fully compromised network, stealing yet more files before encrypting everything and demanding a hefty ransom. It’s a one-two punch that can devastate any business.
Needless to say, this is a true nightmare scenario you don’t want to live through. Be sure your employees and IT staff are on high alert. An Emotet/Trickbot attack is something to be avoided at all cost.
What happened next
Emotet’s comeback did not last. On January 27, 2021, police and prosecutors from the Netherlands, Germany, the United States, the United Kingdom, France, Lithuania, Canada and Ukraine took control of its infrastructure “from the inside.” They seized hundreds of servers and redirected infected computers to systems run by law enforcement, according to Eurojust’s announcement of the Emotet takedown.
Then the two malware families from this article traded places. In November 2021, researchers found Emotet being rebuilt by using computers already infected with Trickbot, as BleepingComputer reported on November 15, 2021.
Trickbot itself was dismantled in 2022, and one of its developers was sentenced to more than five years in a U.S. prison in January 2024 (Justice Department announcement). In May 2024, Operation Endgame took down more than 100 servers used by Trickbot and newer loaders such as IcedID, SmokeLoader and Bumblebee (The Record’s coverage of Operation Endgame). On May 30, 2025, German police named Vitaly Kovalev, known as “Stern,” as the suspected founder of Trickbot and leader of the group behind the Ryuk and Conti ransomware mentioned above (BleepingComputer’s report).
The names change, but the method in this article is still common. Booby-trapped emails install a loader, the loader steals credentials and spreads, and a ransomware group follows.
What to do now
- Block Office macros in files that come from the internet, and filter attachments that disguise themselves as invoices or shipping notices.
- Require multi-factor authentication so stolen browser passwords and cookies are less useful.
- Separate your network so one infected computer can’t reach every server.
- Keep backups offline or immutable, and practice restoring them.
Our security awareness training teaches staff to spot these emails, and our cybersecurity services handle the technical controls.