The TrickBot banking trojan has evolved with a new malware spreading module that uses a stealth mode to quietly infect Windows domain controllers without being detected. In April 2020, TrickBot developers released an updated worm module called ‘Nworm’ The new module encrypts the TrickBot executable so it can’t be detected by security software, but also launches the infection on the domain controller in memory. TrickBot also partners with ransomware operators, such as Ryuk, to gain access to a compromised network so they can deploy ransomware.
Source: https://www.bleepingcomputer.com/news/security/nworm-trickbot-gang-s-new-stealthy-malware-spreading-module/