Trojans: the malware you invite in, and how the FBI uninstalled it
The original Trojan Horse did not knock down the walls of Troy. The Trojans pulled it inside themselves , because it looked like a gift. Computer trojans work the same way, and that is why they are still one of the most successful kinds of malware ever made. They do not need a fancy exploit. They need you to click. What a trojan actually is A trojan is malware wearing a costume. It might look…
Trojans are a type of malware that masquerade as harmless files or software, often enticed by users clicking on them. Their name comes from the ancient tale of the Trojan Horse, where invaders hid inside a gift to breach a city's defenses. In the digital world, a trojan can look like an invoice, cracked game, free software, browser update, PDF reader, wallet tool, job test, or recruiter's recommendation.
Once installed, its primary purpose is to steal sensitive information, such as passwords and keystrokes, or grant unauthorized remote access. There are various classifications of trojans, including remote access trojans (RATs), which grant unauthorized control to an attacker.
The most infamous example of a trojan is the banking trojan, which first emerged in 2007 with Zeus. This trojan would sit inside a user's browser, stealing online banking credentials and sometimes altering the appearance of the page to trick the user into entering additional information. Following Zeus, variants like GameOver Zeus further solidified the FBI's Cyber Most Wanted list.
Another notable example is Emotet, which originated as a banking trojan in 2014 before evolving into a loader, a tool that distributes other malicious software. Emotet's operators turned it into a cybercrime delivery service, renting out infected machines to other criminals, including ransomware gangs.
Law enforcement agencies have successfully dismantled trojan networks through clever tactics. In January 2021, Europol coordinated an international operation against Emotet, taking control of its infrastructure and pushing an update that disconnected infected machines from the criminals. This update also instructed the trojan to remove itself in April 2021.
The takedown was so successful that Emotet resurfaced in a weakened form, but the impact was still significant. In August 2023, the FBI executed Operation Duck Hunt to combat Qakbot, another loader that had facilitated ransomware groups. The operation redirected infected computers to controlled servers, which then installed an uninstaller, cleaning over 700,000 machines and seizing around $8.6 million in cryptocurrency.
Operation Endgame in May 2024 was the largest botnet takedown ever, targeting multiple loaders, such as IcedID, SmokeLoader, Pikabot, and Bumblebee.
To avoid becoming victims of trojan attacks, it is crucial to avoid enabling macros in unexpected documents, downloading software only from official sources, and being cautious with unexpected attachments in old email threads, as reply chain hijacking can make them appear trustworthy. Running untrusted code in a sandbox or virtual machine, especially from take-home tests, is also advisable.
Keeping endpoint protection updated and using non-admin accounts can help prevent trojans from causing extensive damage. In essence, the success of trojans lies in exploiting human trust in seemingly harmless files, but the same infrastructure can also be repurposed by authorities to neutralize their threat.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
