TrickBot Survived Every Takedown Attempt

In the old Greek stories, there was a monster called the Hydra. It lived in a swamp, had many heads, and had one terrible trick. If a hero cut off one head, two more grew back in its place.

In October 2020, the biggest technology companies in the world picked up their swords and went hunting for a monster of the modern age. Microsoft led the charge, joined by security firms and telecom partners from different countries. A court gave them permission, and the command system of a huge criminal network was knocked out in one coordinated strike.

Headlines celebrated. And then, quietly, within a few weeks, the monster started growing its heads back.

The monster’s name was TrickBot, and its story explains why some criminal networks are almost impossible to kill with a single blow, and why a tiny infection should never be treated as a small thing.

What TrickBot is and what it does

TrickBot began in 2016 as a banking trojan. That name needs a simple explanation. A trojan is malware that pretends to be something harmless so a person will let it in. A banking trojan has one first job: stealing online banking logins.

It grew out of an earlier banking trojan family called Dyre. Dyre had already shown criminals how profitable stolen bank details could be. TrickBot took that idea and kept adding new skills.

Once it got inside a computer, TrickBot could watch for banking activity, steal usernames and passwords, and send the stolen details back to the criminals controlling it. It also collected information about the machine itself, which helped its operators decide what the victim was worth.

But stealing bank logins was only the beginning.

TrickBot did not stay a mere thief. Over time it turned into a crime platform. That means the people behind it stopped doing only their own crimes. They rented access to infected computers out to other gangs, the way a landlord rents out rooms. A criminal group that wanted to enter a company network did not always need to break in itself. It could pay for a door that TrickBot had already opened.

Inside a company, a TrickBot infection often became the open door through which far worse attacks entered. Security researchers and investigators linked that path again and again to ransomware, first to a ransomware family called Ryuk and later to one called Conti. Ransomware locks a victim’s files and demands money to unlock them. TrickBot rarely demanded that money itself. Its job was earlier and quieter: get inside, spread, map the building, and hold the door.

That is what made it so valuable, and so dangerous. TrickBot was not just stealing from the computer it infected. It was turning that computer into a base for the next, much bigger crime.

How TrickBot spreads and how it can reach you

TrickBot spread mainly through phishing emails. A phishing email is a fake message designed to look real. It might pretend to be an invoice, a delivery note, a payment warning, or a message from a company a person already trusts. The message pushes the reader to open an attachment or click a link. If that trap works, the infection begins.

This matters for ordinary people because the journey to a huge company attack could start on a very ordinary desk. One office worker opening one convincing email could give criminals a first foothold. One home user with a weak password could become part of a botnet. A botnet is a network of infected computers controlled by criminals without their owners knowing.

After the first computer fell, TrickBot tried not to stay alone. Inside an office network, it crawled from machine to machine by stealing passwords and abusing shared connections between machines. Offices link computers together so staff can share files and printers, but those same helpful links become roads for malware once one machine falls and the passwords protecting the others are weak or reused.

So the spread had two stages. Outside the building, it travelled by trick messages. Inside, it travelled by stolen keys and shared doors.

A home computer could also be stolen from, spied on, or rented out as part of the machine army. No infected computer was only a private problem. Each one became a tool criminals could use against somebody else.

The damage story: the day the swords came down

By 2020, TrickBot had become one of the world’s most feared malware networks. Its link to ransomware made governments especially nervous. If criminals could use it to enter hospitals, companies, or public systems, a stolen password could grow into a national emergency.

In October 2020, a coalition led by Microsoft, together with security and telecom partners around the world, went to court and won permission to strike back. They knocked out much of TrickBot’s command system, the hidden control structure that told infected computers what to do. Cut the command system, and the army of infected machines should have gone silent.

The timing mattered. Officials feared that ransomware built on top of TrickBot could strike systems around the approaching United States election. American newspapers also reported that US Cyber Command had acted against TrickBot separately from the Microsoft-led operation. For a short moment, it looked as if governments and private companies together had finally landed the killing blow.

TrickBot was badly hurt. There is no need to pretend the operation failed at everything. It disrupted criminals, raised their costs, and forced them to rebuild under pressure. But badly hurt is not dead. Within weeks, TrickBot had rebuilt itself, to the frustration of everyone who had celebrated.

Personally, I think this is the part that should stay in every reader’s mind, because a monster that keeps growing new heads cannot be beaten by one good sword swing alone.

Why could it return? TrickBot was never just one server or one office. It was people, backup systems, stolen access, money, and knowledge spread across places no single court order could reach. Seizing part of the command system hurt the body, but the operators survived, and operators can build new command systems.

The fight did not end in 2020. In 2023, the United States and United Kingdom publicly sanctioned several men they identified as members of the TrickBot group. Sanctions can freeze money and make travel and business far harder. The US also charged TrickBot members with computer crimes, as announced by the governments.

One of its developers, a Latvian woman named Alla Witte, was arrested in 2021 and later pleaded guilty in a US court, as widely reported. Her case showed something important about these gangs. They are not magical figures in dark rooms. They are real people with real jobs inside the crime business, and real people can be arrested, charged, and punished.

After internal chats of the Conti gang leaked in 2022, researchers reported that TrickBot’s operators were folding their work into other crime brands. That is the hydra story in modern clothes. Even when one name fades, the people, tools, and habits can reappear under a fresh name, working for a different gang.

The real damage, then, was never only the money stolen by TrickBot itself. It was the endless list of doors it opened for others: stolen bank details, hijacked company networks, ransomware attacks that began long before the ransom note appeared, and the huge cost of hunting a network that refused to stay dead.

How to protect yourself from a TrickBot-style attack

You cannot personally seize a criminal server, but you can close the small doors these gangs depend on.

First, treat email attachments and links with suspicion, even when the message looks professional. Criminals copy real invoices and real company designs. If a message asks you to open a file, enable content, or sign in quickly because of a problem, slow down. Open your bank or delivery service through its official app or by typing its address yourself, not through the link in the message.

Second, turn on two-factor sign-in for banking and for your main email account. Two-factor sign-in means the service asks for a second proof, usually a code or an approval on your phone, besides your password. If TrickBot-style malware steals a password, that second proof can stop the thief from walking straight into the account. Your email deserves the same protection as your bank, because password resets for other services usually travel through email.

Third, keep your computer, phone, browser, and apps updated. Updates are not just new designs. They close security holes that malware uses to enter and to move. Turning on automatic updates is one of the simplest defences there is.

Fourth, use long, different passwords for important accounts. If one stolen password is the same everywhere, one small theft becomes a total disaster. A password manager can help create and remember different passwords safely.

Fifth, treat any infection warning seriously. Many people ignore a strange pop-up, a slow computer, or a security alert because the machine still seems to work. TrickBot’s whole business depended on staying useful and quiet after infection. If a trusted security program reports malware, disconnect the device from the internet if you can, run a full scan, change important passwords from a clean device, and get professional help for a work computer. On an office network, reporting a suspicious email quickly can protect every other machine in the building.

Finally, keep backups of important files in a place not always connected to your computer. Backups do not stop TrickBot entering, but they limit what ransomware gangs can threaten later. The lesson is plain: a small infection is never small. The bank-login thief on one office computer was the scout for the ransomware army that arrived later.

Common questions

What is TrickBot in simple words?

TrickBot is malware that began as a banking trojan in 2016, built to steal online banking logins. It grew into a crime platform that rented infected computers to other gangs. Those gangs often used the access TrickBot provided to launch ransomware attacks.

Did Microsoft kill TrickBot in 2020?

No. The Microsoft-led coalition knocked out much of its command system in October 2020 and badly disrupted it. TrickBot rebuilt itself within weeks, which is why its story is so often used as an example of how hard botnets are to destroy completely.

How does TrickBot get onto a computer?

It spread mainly through phishing emails carrying malicious attachments or links. After entering one computer on a network, it could steal passwords and abuse shared connections to crawl to other machines. One careless click could therefore become a problem for a whole office.

Why do officials worry about a banking trojan so much?

Because TrickBot stopped being only a banking thief. It gave other criminals ready-made access to infected company networks. That access could then be used for ransomware families such as Ryuk and Conti, turning a quiet infection into a shutdown of a business or service.

Can an ordinary person do anything against something this big?

Yes, because the biggest attacks often begin with the smallest openings. Careful email habits, updates, different passwords, and two-factor sign-in close the doors TrickBot needed most. Reporting a suspicious message at work can also stop one infection from becoming a company-wide disaster.

Sources

• Wikipedia — TrickBot: https://en.wikipedia.org/wiki/TrickBot