{"id":47850,"date":"2016-03-04T14:42:17","date_gmt":"2016-03-04T22:42:17","guid":{"rendered":"https:\/\/blogs.mcafee.com\/?p=47850"},"modified":"2025-06-06T02:15:17","modified_gmt":"2025-06-06T09:15:17","slug":"trillium-toolkit-leads-widespread-malware","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-toolkit-leads-widespread-malware\/","title":{"rendered":"Trillium Toolkit Leads to Widespread Malware"},"content":{"rendered":"<p>Any aspiring cybercriminal can buy\u00a0one of many malicious toolkits to craft a downloader and distribute malware.\u00a0After a time these downloaders are\u00a0leaked to forums and other download sites and become available to the masses. This is often when we see a spike in their use.<\/p>\n<p>The toolkit Trillium Security MultiSploit Tool v3 was cracked last week and uploaded onto several malicious forums.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-47851\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/tril_010316_001.jpg\" alt=\"tril_010316_001\" width=\"865\" height=\"747\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/tril_010316_001.jpg 865w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/tril_010316_001-300x259.jpg 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/tril_010316_001-768x663.jpg 768w\" sizes=\"auto, (max-width: 865px) 100vw, 865px\" \/><\/p>\n<p>Trillium was created by a coder using the same name. The program contains a EULA that mentions it should not be used maliciously, but we are well aware that these types of kits are used for\u00a0generating malware.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-47852\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/tril_010316_002.jpg\" alt=\"tril_010316_002\" width=\"457\" height=\"304\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/tril_010316_002.jpg 457w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/tril_010316_002-300x200.jpg 300w\" sizes=\"auto, (max-width: 457px) 100vw, 457px\" \/><\/p>\n<p>In order to use the builder, the user\u00a0needs to acknowledge the EULA by\u00a0clicking on a button. So we guess everyone who is using it is violating the policy.<\/p>\n<p>Whenever you use the tool to create an exploit or a downloader you are reminded yet again not to use it maliciously.<\/p>\n<p>.<img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-47853\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/tril_010316_003.jpg\" alt=\"tril_010316_003\" width=\"274\" height=\"116\" \/><\/p>\n<p>Version 1 of this this tool appeared for sale at the end of last year for US$300 on a popular hacking forum. Since then, it has been updated to Version 3.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-47854\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/tril_010316_004.jpg\" alt=\"tril_010316_004\" width=\"852\" height=\"865\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/tril_010316_004.jpg 852w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/tril_010316_004-295x300.jpg 295w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/tril_010316_004-768x780.jpg 768w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/tril_010316_004-32x32.jpg 32w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/tril_010316_004-64x64.jpg 64w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/tril_010316_004-96x96.jpg 96w\" sizes=\"auto, (max-width: 852px) 100vw, 852px\" \/><\/p>\n<p>This toolkit allows the user to create several types of downloaders. It breaks them down into three\u00a0options:<\/p>\n<ul>\n<li>Windows shortcut exploits<\/li>\n<li>Silent exploit<\/li>\n<li>Macro exploits<\/li>\n<\/ul>\n<p><strong>Windows shortcut exploits\u00a0<\/strong>rename an executable to a specified filename and create a LNK file that\u00a0uses PowerShell to execute.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-47855\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/tril_010316_005.jpg\" alt=\"tril_010316_005\" width=\"370\" height=\"393\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/tril_010316_005.jpg 370w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/tril_010316_005-282x300.jpg 282w\" sizes=\"auto, (max-width: 370px) 100vw, 370px\" \/><\/p>\n<p>This type offers the option to use different icons and file extensions, all to trick the target into executing the LNK file.<\/p>\n<p>A<strong>\u00a0silent exploit\u00a0<\/strong>creates a file that downloads and executes a specified file from the Internet. The users have the option to create the following file types:<\/p>\n<p style=\"padding-left: 30px;\"><em>*.chm,*.wsf, *.vbs, *.hta, *.htm, *.html, *.bat, *.cmd, *.ps1, *.<\/em><em>psc1, *.exe, *.pif, *.scr, *.com, *.url, *.lnk<\/em><\/p>\n<p>Depending on the chosen options, the toolkit will create one of the following files:<\/p>\n<ul>\n<li>A Powershell script<\/li>\n<li>A Visual Basic executable<\/li>\n<li>A Visual Basic script<\/li>\n<\/ul>\n<p>The\u00a0PowerShell script, executed as hidden, downloads and runs a file.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-47856\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/tril_010316_007.jpg\" alt=\"tril_010316_007\" width=\"732\" height=\"187\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/tril_010316_007.jpg 732w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/tril_010316_007-300x77.jpg 300w\" sizes=\"auto, (max-width: 732px) 100vw, 732px\" \/><\/p>\n<p>The Visual Basic executable downloads and executes a file.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-47858\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/tril_010316_011.jpg\" alt=\"tril_010316_011\" width=\"643\" height=\"240\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/tril_010316_011.jpg 643w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/tril_010316_011-300x112.jpg 300w\" sizes=\"auto, (max-width: 643px) 100vw, 643px\" \/><\/p>\n<p>The Visual Basic script\u00a0again downloads and executes a file.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-47859\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/tril_010316_032.jpg\" alt=\"tril_010316_032\" width=\"900\" height=\"189\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/tril_010316_032.jpg 900w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/tril_010316_032-300x63.jpg 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/tril_010316_032-768x161.jpg 768w\" sizes=\"auto, (max-width: 900px) 100vw, 900px\" \/><\/p>\n<p><strong>Macro exploits <\/strong>allow users to create a macro that\u00a0will download and execute a file. This type of attack is very common today; we have seen it used to spread <a href=\"https:\/\/securingtomorrow.mcafee.com\/mcafee-labs\/banking-malware-dridex-arrives-via-phishing-email\/\" target=\"_blank\" rel=\"noopener\">Dridex<\/a> and other ransomware families. The tool can create several macro versions, for\u00a0example:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-47870\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/tril_010316_013.jpg\" alt=\"tril_010316_013\" width=\"626\" height=\"285\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/tril_010316_013.jpg 626w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/tril_010316_013-300x137.jpg 300w\" sizes=\"auto, (max-width: 626px) 100vw, 626px\" \/><\/p>\n<p>We have already observed this toolkit being used\u00a0to distribute malware.\u00a0We have seen spam campaigns using the macro exploit component, for example:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-47967\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/tril_010316_014-2.jpg\" alt=\"tril_010316_014\" width=\"631\" height=\"738\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/tril_010316_014-2.jpg 631w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/tril_010316_014-2-257x300.jpg 257w\" sizes=\"auto, (max-width: 631px) 100vw, 631px\" \/><\/p>\n<h2><strong>Detection<\/strong><\/h2>\n<p>McAfee has several drivers that\u00a0detect the files created by this toolkit.\u00a0Detection is included in DAT Versions 8094 and later.<\/p>\n<ul>\n<li>Trojan-FHYT<\/li>\n<li>Trojan-FHYU<\/li>\n<li>W97M\/Downloader.azi<\/li>\n<li>W97M\/Downloader.azj<\/li>\n<li>W97M\/Downloader.azk<\/li>\n<\/ul>\n<p>We also recommend our customers read <a href=\"https:\/\/securingtomorrow.mcafee.com\/mcafee-labs\/best-practices-for-preventing-dridex-infections-2\/\" target=\"_blank\" rel=\"noopener\">this blog\u00a0<\/a>containing preventive measures against Dridex. The advice\u00a0should help\u00a0mitigate some of the infections seen by malware created by this toolkit.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Any aspiring cybercriminal can buy\u00a0one of many malicious toolkits to craft a downloader and distribute malware.\u00a0After a time these downloaders&#8230;<\/p>\n","protected":false},"author":774,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[442],"tags":[76,4452,180],"coauthors":[849,854],"class_list":["post-47850","post","type-post","status-publish","format-standard","hentry","category-mcafee-labs","tag-cybercrime","tag-cybersecurity","tag-malware"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v25.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Trillium Toolkit Leads to Widespread Malware | McAfee Blog<\/title>\n<meta name=\"description\" content=\"Any aspiring cybercriminal can buy\u00a0one of many malicious toolkits to craft a downloader and distribute malware.\u00a0After a time these downloaders are\u00a0leaked\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Trillium Toolkit Leads to Widespread Malware | McAfee Blog\" \/>\n<meta property=\"og:description\" content=\"Any aspiring cybercriminal can buy\u00a0one of many malicious toolkits to craft a downloader and distribute malware.\u00a0After a time these downloaders are\u00a0leaked\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-toolkit-leads-widespread-malware\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:published_time\" content=\"2016-03-04T22:42:17+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-06-06T09:15:17+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/tril_010316_001.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"865\" \/>\n\t<meta property=\"og:image:height\" content=\"747\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Oliver Devane, Mohinder Gill\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@McAfee\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Oliver Devane, Mohinder Gill\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-toolkit-leads-widespread-malware\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-toolkit-leads-widespread-malware\/\"},\"author\":{\"name\":\"Oliver Devane\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/f3e79f95122a1e56c0b07811a4f2188a\"},\"headline\":\"Trillium Toolkit Leads to Widespread Malware\",\"datePublished\":\"2016-03-04T22:42:17+00:00\",\"dateModified\":\"2025-06-06T09:15:17+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-toolkit-leads-widespread-malware\/\"},\"wordCount\":485,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-toolkit-leads-widespread-malware\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/tril_010316_001.jpg\",\"keywords\":[\"cybercrime\",\"cybersecurity\",\"malware\"],\"articleSection\":[\"McAfee Labs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-toolkit-leads-widespread-malware\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-toolkit-leads-widespread-malware\/\",\"name\":\"Trillium Toolkit Leads to Widespread Malware | McAfee Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-toolkit-leads-widespread-malware\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-toolkit-leads-widespread-malware\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/tril_010316_001.jpg\",\"datePublished\":\"2016-03-04T22:42:17+00:00\",\"dateModified\":\"2025-06-06T09:15:17+00:00\",\"description\":\"Any aspiring cybercriminal can buy\u00a0one of many malicious toolkits to craft a downloader and distribute malware.\u00a0After a time these downloaders are\u00a0leaked\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-toolkit-leads-widespread-malware\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-toolkit-leads-widespread-malware\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-toolkit-leads-widespread-malware\/#primaryimage\",\"url\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/tril_010316_001.jpg\",\"contentUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/tril_010316_001.jpg\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-toolkit-leads-widespread-malware\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Other Blogs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"McAfee Labs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Trillium Toolkit Leads to Widespread Malware\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/f3e79f95122a1e56c0b07811a4f2188a\",\"name\":\"Oliver Devane\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/145287b0eca301fc80d99baf060dd274\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/Oliver-Devane-96x96.jpg\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/Oliver-Devane-96x96.jpg\",\"caption\":\"Oliver Devane\"},\"description\":\"Oliver Devane is currently a Senior Security Researcher at McAfee. He is based in the UK office and has over 10 years of experience analyzing Malware and Potentially Unwanted Programs.\",\"sameAs\":[\"https:\/\/www.linkedin.com\/in\/oliver-devane-1a528749\/\"],\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/oliver-devane\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Trillium Toolkit Leads to Widespread Malware | McAfee Blog","description":"Any aspiring cybercriminal can buy\u00a0one of many malicious toolkits to craft a downloader and distribute malware.\u00a0After a time these downloaders are\u00a0leaked","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"Trillium Toolkit Leads to Widespread Malware | McAfee Blog","og_description":"Any aspiring cybercriminal can buy\u00a0one of many malicious toolkits to craft a downloader and distribute malware.\u00a0After a time these downloaders are\u00a0leaked","og_url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-toolkit-leads-widespread-malware\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_published_time":"2016-03-04T22:42:17+00:00","article_modified_time":"2025-06-06T09:15:17+00:00","og_image":[{"width":865,"height":747,"url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/tril_010316_001.jpg","type":"image\/jpeg"}],"author":"Oliver Devane, Mohinder Gill","twitter_card":"summary_large_image","twitter_creator":"@McAfee","twitter_site":"@McAfee","twitter_misc":{"Written by":"Oliver Devane, Mohinder Gill","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-toolkit-leads-widespread-malware\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-toolkit-leads-widespread-malware\/"},"author":{"name":"Oliver Devane","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/f3e79f95122a1e56c0b07811a4f2188a"},"headline":"Trillium Toolkit Leads to Widespread Malware","datePublished":"2016-03-04T22:42:17+00:00","dateModified":"2025-06-06T09:15:17+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-toolkit-leads-widespread-malware\/"},"wordCount":485,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-toolkit-leads-widespread-malware\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/tril_010316_001.jpg","keywords":["cybercrime","cybersecurity","malware"],"articleSection":["McAfee Labs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-toolkit-leads-widespread-malware\/","url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-toolkit-leads-widespread-malware\/","name":"Trillium Toolkit Leads to Widespread Malware | McAfee Blog","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-toolkit-leads-widespread-malware\/#primaryimage"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-toolkit-leads-widespread-malware\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/tril_010316_001.jpg","datePublished":"2016-03-04T22:42:17+00:00","dateModified":"2025-06-06T09:15:17+00:00","description":"Any aspiring cybercriminal can buy\u00a0one of many malicious toolkits to craft a downloader and distribute malware.\u00a0After a time these downloaders are\u00a0leaked","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-toolkit-leads-widespread-malware\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-toolkit-leads-widespread-malware\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-toolkit-leads-widespread-malware\/#primaryimage","url":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/tril_010316_001.jpg","contentUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/tril_010316_001.jpg"},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-toolkit-leads-widespread-malware\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Other Blogs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/"},{"@type":"ListItem","position":3,"name":"McAfee Labs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/"},{"@type":"ListItem","position":4,"name":"Trillium Toolkit Leads to Widespread Malware"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/f3e79f95122a1e56c0b07811a4f2188a","name":"Oliver Devane","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/145287b0eca301fc80d99baf060dd274","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/Oliver-Devane-96x96.jpg","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/Oliver-Devane-96x96.jpg","caption":"Oliver Devane"},"description":"Oliver Devane is currently a Senior Security Researcher at McAfee. He is based in the UK office and has over 10 years of experience analyzing Malware and Potentially Unwanted Programs.","sameAs":["https:\/\/www.linkedin.com\/in\/oliver-devane-1a528749\/"],"url":"https:\/\/www.mcafee.com\/blogs\/author\/oliver-devane\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/47850","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/774"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=47850"}],"version-history":[{"count":2,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/47850\/revisions"}],"predecessor-version":[{"id":215200,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/47850\/revisions\/215200"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=47850"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=47850"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=47850"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=47850"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}