MITRE ATT&CK Malware

TrickBot (S0266)

TotbrickTSPY_TRICKLOAD

ShareX LinkedIn Reddit HN

[TrickBot](https://attack.mitre.org/software/S0266) is a Trojan spyware program written in C++ that first emerged in September 2016 as a possible successor to [Dyre](https://attack.mitre.org/software/S0024). [TrickBot](https://attack.mitre.org/software/S0266) was developed and initially used by [Wizard Spider](https://attack.mitre.org/groups/G0102) for targeting banking sites in North America, Australia, and throughout Europe; it has since been used against all sectors worldwide as part of "big game hunting" ransomware campaigns.(Citation: S2 Grupo TrickBot June 2017)(Citation: Fidelis TrickBot Oct 2016)(Citation: IBM TrickBot Nov 2016)(Citation: CrowdStrike Wizard Spider October 2020)

Platforms: Windows

▪Techniques implemented (55)

T1082System Information Discovery T1033System Owner/User Discovery T1559.001Component Object Model T1053.005Scheduled Task T1542.003Bootkit T1185Browser Session Hijacking T1106Native API T1059.001PowerShell T1041Exfiltration Over C2 Channel T1008Fallback Channels T1021.005VNC T1027Obfuscated Files or Information T1543.003Windows Service T1027.002Software Packing T1552.001Credentials In Files T1204.002Malicious File T1573.001Symmetric Cryptography T1087.001Local Account T1135Network Share Discovery T1132.001Standard Encoding T1566.002Spearphishing Link T1005Data from Local System T1069Permission Groups Discovery T1552.002Credentials in Registry T1057Process Discovery T1087.003Email Account T1497.003Time Based Checks T1219Remote Access Tools T1059.003Windows Command Shell T1685Disable or Modify Tools T1036Masquerading T1495Firmware Corruption T1140Deobfuscate/Decode Files or Information T1018Remote System Discovery T1571Non-Standard Port T1555.005Password Managers T1112Modify Registry T1553.002Code Signing T1110.004Credential Stuffing T1083File and Directory Discovery T1056.004Credential API Hooking T1007System Service Discovery T1105Ingress Tool Transfer T1055Process Injection T1090.002External Proxy T1055.012Process Hollowing T1210Exploitation of Remote Services T1564.003Hidden Window T1547.001Registry Run Keys / Startup Folder T1071.001Web Protocols T1027.013Encrypted/Encoded File T1555.003Credentials from Web Browsers T1482Domain Trust Discovery T1016System Network Configuration Discovery T1566.001Spearphishing Attachment

▪Used by groups (2)

G0102Wizard Spider G0092TA505

S0266on MITRE ATT&CK →

MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.