The following graph shows the rate of discovery of TrickBot versions in the wild, based on shared mcconfs. (Note: The flatter the line, the more frequently versions are discovered.)
Four new versions discovered in the last week (1000086, 1000087, 1000088 and 1000089), three the week before, and four the week before that.
- 443 (HTTPS);
- 445 (IBM AS Server Mapper);
- 449 (Cray Network Semaphore Server); and
- 451 (SMB).
The following table the BGP allocations of C2 servers' IP addresses to country by TrickBot version.