US Cyber Command disrupted the notorious Trickbot botnet

The US Cyber Command, the Defense Department division in charge of its cyberspace operations, recently mounted an operation to disrupt one of the most massive and notorious botnets today. According to The Washington Post, CyberCom successfully (albeit temporarily) interrupted the Trickbot botnet’s operations at least a couple of times over the last few weeks. The botnet is composed of at least a million hijacked computers infected with the Trickbot malware and reportedly run by Russian-speaking criminals.

KrebsonSecurity, which was the first to report on the disruptions, the entity that interrupted the botnet sent infected computers a command that disconnected them from the servers Trickbot’s operators used to control them. Also, the entity filled the Trickbot database with bogus records to confuse the operators. At the time, Krebs didn’t have information on who or what was responsible.

The Trickbot malware can be used to steal sensitive information, such as financial data and login credentials, and the botnet can be used to infect systems with ransomware. Just this September, the botnet was used against healthcare provider Universal Health Services in an attack that locked up its network with a ransomware called Ryuk.