ATT&CK

Threat actorsMITRE ATT&CK intrusion sets Malware & toolsSoftware families & tooling TechniquesTactics & techniques

ReportsPublished APT reporting SourcesEvery feed behind the archive

Developers

JSON APIFree CORS-enabled endpoints MCP serverModel Context Protocol access Source codeThis project on GitHub

Loading the archive…

Open Threat Intel Archive

Indicators are treated as facts and kept with their source_vendor, source URL, and dates; every feed is credited and redistribution-restricted feeds are flagged, not dropped. ATT&CK content is © MITRE, used under its terms. See NOTICE. The archive reports intelligence; it does not editorialize threat.

Indicators Actors Sources API GitHub

Open Threat Intel Archive

← Malware & tools

S0266malware

TrickBot

a.k.a. Totbrick, TSPY_TRICKLOAD

TrickBot is a Trojan spyware program written in C++ that first emerged in September 2016 as a possible successor to Dyre. TrickBot was developed and initially used by Wizard Spider for targeting banking sites in North America, Australia, and throughout Europe; it has since been used against all sectors worldwide as part of "big game hunting" ransomware campaigns.

Platforms: Windows

MITRE ATT&CK ↗

Linked entities · 24

usesT1082System Information Discovery usesT1033System Owner/User Discovery usesT1559.001Component Object Model usesT1053.005Scheduled Task usesT1542.003Bootkit usesT1185Browser Session Hijacking usesT1106Native API usesT1059.001PowerShell usesT1041Exfiltration Over C2 Channel usesT1008Fallback Channels usesT1021.005VNC usesT1027Obfuscated Files or Information usesT1543.003Windows Service usesT1027.002Software Packing usesT1552.001Credentials In Files usesT1204.002Malicious File usesT1573.001Symmetric Cryptography usesT1087.001Local Account usesT1135Network Share Discovery usesT1132.001Standard Encoding usesT1566.002Spearphishing Link usesT1005Data from Local System usesT1069Permission Groups Discovery usesT1552.002Credentials in Registry