Trickgate, a sophisticated cybercrime tool, was discovered by Check Point researchers in late January. Available on the darknet, Trickgate enables cybercriminals to circumvent EDR protection, which is widely used by businesses to detect malicious software and prevent attacks. Cybercriminals use Trickgate to deploy malware discreetly, without being detected by EDRs. According to Check Point’s cybersecurity expert Adrien Merveille, Trickgate is comparable to an envelope in which the malware is hidden, making it invisible to most protection mechanisms.
The fact that Trickgate was designed to bypass EDRs is not surprising, as hackers fear EDRs, which can detect malware as soon as it appears and block it. EDRs have been widely deployed by businesses in recent years, which explains why Trickgate was developed to bypass them. Cybercriminals have managed to stay under the radar of cybersecurity monitors by regularly changing the form of Trickgate to keep it anonymous.
Although Trickgate is a sophisticated tool, this does not mean that EDRs are obsolete. EDRs are composed of several engines that identify different elements in the context of an attack, which is essential for detecting various types of malware. EDRs will always be necessary, but their evolution is inevitable. However, no security system can guarantee 100% protection, according to Adrien Merveille.
Exclusivité DPO PARTAGE
Vos questions sur le RGPD
Gratuitement, poser vos questions sur la conformité RGPD.
Une réponse sous 24/48h à votre problématique.
Cybersecurity professionals are not alarmed by the discovery of Trickgate. Philippe Hameau, an RSSI who has implemented EDRs, believes that this new vector is not a threat to EDRs and that it encourages professionals to focus more on attack vectors. Franck Rouxel, co-president of Agora RSSI, reminds that security is not limited to protection tools, but requires a solid architecture to operate and maintain IT networks.
In summary, Trickgate is a sophisticated cybercrime tool that bypasses EDRs, but this does not mean the end of EDRs. Cybersecurity professionals must continue to evolve and adapt their defenses to fight against cybercriminals and their sophisticated tools.
