{ "id": "1417a24a-85fc-4f8a-acf3-6e3a9ddab6e5", "created_at": "2026-04-06T00:14:35.32534Z", "updated_at": "2026-04-10T03:37:23.826145Z", "deleted_at": null, "sha1_hash": "a7e2cf509c1d45f2cac1aca8390be289f0ec92d5", "title": "TrickBot teams up with Shatak phishers for Conti ransomware attacks", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 2377117, "plain_text": "TrickBot teams up with Shatak phishers for Conti ransomware attacks\r\nBy Bill Toulas\r\nPublished: 2021-11-10 · Archived: 2026-04-06 00:04:19 UTC\r\nA threat actor tracked as Shatak (TA551) recently partnered with the ITG23 gang (aka TrickBot and Wizard Spider) to\r\ndeploy Conti ransomware on targeted systems.\r\nThe Shatak operation partners with other malware developers to create phishing campaigns that download and infect victims\r\nwith malware.\r\nResearchers from IBM X-Force discovered that Shatak and TrickBot began working together in July 2021, with what\r\nappears to be good results, as the campaigns have continued until today.\r\nhttps://www.bleepingcomputer.com/news/security/trickbot-teams-up-with-shatak-phishers-for-conti-ransomware-attacks/\r\nPage 1 of 5\n\n0:00\r\nhttps://www.bleepingcomputer.com/news/security/trickbot-teams-up-with-shatak-phishers-for-conti-ransomware-attacks/\r\nPage 2 of 5\n\nVisit Advertiser websiteGO TO PAGE\r\nA recent technical analysis from Cybereason provides more details on how the two distinct actors partnered to deliver\r\nransomware attacks.\r\nAttack starts with a phishing email\r\nA typical infection chain starts with a phishing email sent by Shatak, carrying a password-protected archive containing a\r\nmalicious document.\r\nAccording to an October report by IBM X-Force, Shatak commonly uses reply-chain emails stolen from previous victims\r\nand adds password-protected archive attachments.\r\nExample Shatak phishing email\r\nSource: IBM X-Force\r\nThese attachments contain scripts that execute base-64 encoded code to download and install the TrickBot or\r\nBazarBackdoor malware from a remote site.\r\nThe distribution sites used in the most recent campaign are based in European countries such as Germany, Slovakia, and the\r\nNetherlands.\r\nShatak's infection chain\r\nSource: Cybereason\r\nhttps://www.bleepingcomputer.com/news/security/trickbot-teams-up-with-shatak-phishers-for-conti-ransomware-attacks/\r\nPage 3 of 5\n\nAfter successfully deploying TrickBot and/or BazarBackdoor, ITG23 takes over by deploying a Cobalt Strike beacon on the\r\ncompromised system, adding it to the scheduled tasks for persistence.\r\nThe Conti actors then use the dropped BazarBackdoor for network reconnaissance, enumerating users, domain admins,\r\nshared computers, and shared resources.\r\nThen they steal user credentials, password hashes, and Active Directory data, and abuse what they can to spread laterally\r\nthrough the network.\r\nSome signs of this activity include fiddling with registry values that enable the RDP connectivity and modifying Windows\r\nFirewall rules with the 'netsh' command.\r\nWindows Defender's real-time monitoring feature is also disabled to prevent alerts or interventions during the encryption\r\nprocess.\r\nThe next step is data exfiltration, which is the final stage before the file encryption, with Conti using the 'Rclone' tool to\r\nsend everything to a remote endpoint under their control.\r\nConti disabling Defender's real-time protections.\r\nSource: Cybereason\r\nAfter harvesting all valuable data from the network, the threat actors deploy the ransomware to encrypt devices.\r\nOther potential collaborations\r\nIn a recent report from France's Computer Emergency Response Team (CERT), TA551 appears as a collaborator of\r\n'Lockean', a newly discovered ransomware group with multiple affiliations.\r\nIn that case, Shatak was sending phishing emails to distribute the Qbot/QakBot banking trojan, which was used for\r\ndeploying the ProLock, Egregor, and DoppelPaymer ransomware infections.\r\nAs such, TA551 may have more collaborations with other ransomware gangs besides those spotted by analysts.\r\nThis threat actor is also identified under different names, such as Shathak, UNC2420, and Gold Cabin.\r\nHow to protect yourself\r\nThe best defense against these types of attacks is to train employees on the risks of phishing emails.\r\nApart from that, admins should enforce the use of multi-factor authentication on accounts, disable unused RDP services, and\r\nregularly monitor the relevant event logs for unusual configuration changes.\r\nFinally, an important safety measure is regularly backing up important data to a secured remote location and then taking\r\nthose backups offline so they can't be targeted by threat actors.\r\nhttps://www.bleepingcomputer.com/news/security/trickbot-teams-up-with-shatak-phishers-for-conti-ransomware-attacks/\r\nPage 4 of 5\n\nAutomated Pentesting Covers Only 1 of 6 Surfaces.\r\nAutomated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the\r\nother.\r\nThis whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic\r\nquestions for any tool evaluation.\r\nSource: https://www.bleepingcomputer.com/news/security/trickbot-teams-up-with-shatak-phishers-for-conti-ransomware-attacks/\r\nhttps://www.bleepingcomputer.com/news/security/trickbot-teams-up-with-shatak-phishers-for-conti-ransomware-attacks/\r\nPage 5 of 5", "extraction_quality": 1, "language": "EN", "sources": [ "ETDA" ], "references": [ "https://www.bleepingcomputer.com/news/security/trickbot-teams-up-with-shatak-phishers-for-conti-ransomware-attacks/" ], "report_names": [ "trickbot-teams-up-with-shatak-phishers-for-conti-ransomware-attacks" ], "threat_actors": [ { "id": "26a04131-2b8c-4e5d-8f38-5c58b86f5e7f", "created_at": "2022-10-25T15:50:23.579601Z", "updated_at": "2026-04-10T02:00:05.360509Z", "deleted_at": null, "main_name": "TA551", "aliases": [ "TA551", "GOLD CABIN", "Shathak" ], "source_name": "MITRE:TA551", "tools": [ "QakBot", "IcedID", "Valak", "Ursnif" ], "source_id": "MITRE", "reports": null }, { "id": "f6f91e1c-9202-4497-bf22-9cd5ef477600", "created_at": "2023-01-06T13:46:38.86765Z", "updated_at": "2026-04-10T02:00:03.12735Z", "deleted_at": null, "main_name": "WIZARD SPIDER", "aliases": [ "TEMP.MixMaster", "GOLD BLACKBURN", "DEV-0193", "UNC2053", "Pistachio Tempest", "DEV-0237", "Storm-0230", "FIN12", "Periwinkle Tempest", "Storm-0193", "Trickbot LLC" ], "source_name": "MISPGALAXY:WIZARD SPIDER", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "bc119938-a79c-4e5f-9d4d-dc96835dfe2e", "created_at": "2024-06-04T02:03:07.799286Z", "updated_at": "2026-04-10T02:00:03.606456Z", "deleted_at": null, "main_name": "GOLD BLACKBURN", "aliases": [ "ITG23 ", "Periwinkle Tempest ", "Wizard Spider " ], "source_name": "Secureworks:GOLD BLACKBURN", "tools": [ "BazarLoader", "Buer Loader", "Bumblebee", "Dyre", "Team9", "TrickBot" ], "source_id": "Secureworks", "reports": null }, { "id": "40b623c7-b621-48db-b55b-dd4f6746fbc6", "created_at": "2024-06-19T02:03:08.017681Z", "updated_at": "2026-04-10T02:00:03.665818Z", "deleted_at": null, "main_name": "GOLD CABIN", "aliases": [ "Shathak", "TA551 " ], "source_name": "Secureworks:GOLD CABIN", "tools": [], "source_id": "Secureworks", "reports": null }, { "id": "90f216f2-4897-46fc-bb76-3acae9d112ca", "created_at": "2023-01-06T13:46:39.248936Z", "updated_at": "2026-04-10T02:00:03.260122Z", "deleted_at": null, "main_name": "GOLD CABIN", "aliases": [ "Shakthak", "TA551", "ATK236", "G0127", "Monster Libra" ], "source_name": "MISPGALAXY:GOLD CABIN", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "63061658-5810-4f01-9620-7eada7e9ae2e", "created_at": "2022-10-25T15:50:23.752974Z", "updated_at": "2026-04-10T02:00:05.244531Z", "deleted_at": null, "main_name": "Wizard Spider", "aliases": [ "Wizard Spider", "UNC1878", "TEMP.MixMaster", "Grim Spider", "FIN12", "GOLD BLACKBURN", "ITG23", "Periwinkle Tempest", "DEV-0193" ], "source_name": "MITRE:Wizard Spider", "tools": [ "TrickBot", "AdFind", "BITSAdmin", "Bazar", "LaZagne", "Nltest", "GrimAgent", "Dyre", "Ryuk", "Conti", "Emotet", "Rubeus", "Mimikatz", "Diavol", "PsExec", "Cobalt Strike" ], "source_id": "MITRE", "reports": null }, { "id": "e6a21528-2999-4e2e-aaf4-8b6af14e17f3", "created_at": "2022-10-25T16:07:24.422115Z", "updated_at": "2026-04-10T02:00:04.983298Z", "deleted_at": null, "main_name": "Wizard Spider", "aliases": [ "DEV-0193", "G0102", "Gold Blackburn", "Gold Ulrick", "Grim Spider", "ITG23", "Operation BazaFlix", "Periwinkle Tempest", "Storm-0230", "TEMP.MixMaster", "Wizard Spider" ], "source_name": "ETDA:Wizard Spider", "tools": [ "AdFind", "Agentemis", "Anchor_DNS", "BEERBOT", "BazarBackdoor", "BazarCall", "BazarLoader", "Cobalt Strike", "CobaltStrike", "Conti", "Diavol", "Dyranges", "Dyre", "Dyreza", "Dyzap", "Gophe", "Invoke-SMBAutoBrute", "KEGTAP", "LaZagne", "LightBot", "PowerSploit", "PowerTrick", "PsExec", "Ryuk", "SessionGopher", "TSPY_TRICKLOAD", "Team9Backdoor", "The Trick", "TheTrick", "Totbrick", "TrickBot", "TrickLoader", "TrickMo", "Upatre", "bazaloader", "cobeacon" ], "source_id": "ETDA", "reports": null }, { "id": "04e34cab-3ee4-4f06-a6f6-5cdd7eccfd68", "created_at": "2022-10-25T16:07:24.578896Z", "updated_at": "2026-04-10T02:00:05.039955Z", "deleted_at": null, "main_name": "TA551", "aliases": [ "G0127", "Gold Cabin", "Monster Libra", "Shathak", "TA551" ], "source_name": "ETDA:TA551", "tools": [ "BokBot", "CRM", "Gozi", "Gozi CRM", "IceID", "IcedID", "Papras", "Snifula", "Ursnif", "Valak", "Valek" ], "source_id": "ETDA", "reports": null } ], "ts_created_at": 1775434475, "ts_updated_at": 1775792243, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/a7e2cf509c1d45f2cac1aca8390be289f0ec92d5.pdf", "text": "https://archive.orkl.eu/a7e2cf509c1d45f2cac1aca8390be289f0ec92d5.txt", "img": "https://archive.orkl.eu/a7e2cf509c1d45f2cac1aca8390be289f0ec92d5.jpg" } }