The use of crypters to obfuscate malware in order to evade antivirus detection is not new, but TrickBot’s operators – which are known as Wizard Spider, ITG23, or the Trickbot Group – took this practice to a new level, by automating the crypting of malware at scale with the launch of a Jenkins build server.
The TrickBot malware family emerged in 2016, when it mainly facilitated online banking fraud. The malware has evolved into helping the mass distribution of other malware families, and the cybercrime group behind it has widened its activities as well.
