Jump to content

Dridex

From Wikipedia, the free encyclopedia
Dridex
TypeTrojan
SubtypeBanking trojan
AuthorsNecurs Maksim Yakubets

Dridex, also known as Bugat and Cridex, is a form of malware that specializes in stealing bank credentials via a system that utilizes macros from Microsoft Word.[5]

The targets of this malware are Windows users who open an email attachment in Word or Excel, causing macros to activate and download Dridex, infecting the computer and opening the victim to banking theft.

The primary objective of this software is to steal banking information[6] from users of infected machines to immediately launch fraudulent transactions. Bank information for the software installs a keyboard listener and performs injection attacks. During 2015, theft caused by this software was estimated at £20 million in the United Kingdom and $10 million in the United States. By 2015, Dridex attacks had been detected in more than 20 countries. In early September 2016, researchers spotted initial support for targeting cryptocurrency wallets.[7]

In 2017, Dridex was distributed via a widespread phishing campaign exploiting a Microsoft Word zero-day vulnerability, allowing infection without macros and affecting millions of users globally.[8]

In December 2019, US authorities filed charges against two suspects believed to have created the Dridex malware, including the group's alleged leader.[9]

In 2022, IBM researchers found similarities between the Raspberry Robin worm and Dridex malware loaders. Their comparative analysis showed that both used similar string decoding algorithms, anti-analysis techniques, and payload decryption routines. IBM suggested that Evil Corp may be using Raspberry Robin infrastructure to carry out attacks.[10]

Evil Corp

[edit]

Evil Corp (also known as Dridex and INDRIK SPIDER) is a Russian hacking group that has been active since 2009.[11] In 2019, the Federal Bureau of Investigation (FBI) named nine alleged members of the group, accusing them of extorting or stealing over $100,000,000 through hacks that affected 40 countries.[12] That same year, the United States Department of the Treasury imposed sanctions on the group,[13] and the Office of Foreign Assets Control (OFAC) banned individuals in the U.S. from engaging in transactions with them.[14] People outside the US may be subject to secondary sanctions for facilitating significant transactions with the group.[14] The US government also charged two members and offered a $5 million reward for information leading to their arrest.[14]

In November 2021, the BBC reported that two alleged leaders of Evil Corp were living openly in Russia.[12][15] The following month, analysts at Emsisoft suggested that a ransomware attack initially attributed to REvil may have been the work of Evil Corp.[14]

In June of 2022, cybersecurity firm Mandiant reported that Evil Corp had begun using off-the-shelf ransomware, such as LockBit, to disguise its identity and evade sanctions.[14] Mandiant also linked the group to threat actor UNC2165.[14]

Between 2022 and 2024, Evil Corp diversified its tactics and began affiliating with other ransomware groups, including LockBit. The group continued using SocGholish as their primary initial access tool. The UK’s National Crime Agency (NCA) identified Aleksandr Ryzhenkov, a senior figure in Evil Corp, as a LockBit affiliate involved in ransomware attacks. In February 2024, LockBit was disrupted by an international law enforcement operation led by the NCA, known as Operation Cronos. Some Evil Corp members remain active in Russia; in December 2022, Igor Turashev and his company placed third in a hackathon organized by the Wagner Group.[16]

See also

[edit]

References

[edit]
  1. ^ "Cyberthreats, viruses, and malware - Microsoft Security Intelligence". Microsoft.
  2. ^ "Trojan.Dridex".
  3. ^ "Search - Threat Encyclopedia".
  4. ^ "Fortiguard".
  5. ^ "Someone Hijacks Botnet Network & Replaces Malware with an Antivirus". 2016-02-04. Retrieved 2017-01-11.
  6. ^ Jeremy Kirk (2016-01-19). "Dridex banking malware adds a new trick". PCWorld. Retrieved 2017-01-11.
  7. ^ Catalin Cimpanu (2016-09-07). "Dridex Banking Trojan Will Soon Target Crypto-Currency Wallets". Softpedia. Retrieved 2017-01-11.
  8. ^ "Microsoft Word 0-day used to push dangerous Dridex malware on millions". Ars Technica. 11 April 2017. Retrieved 20 April 2025.
  9. ^ Cimpanu, Catalin (December 5, 2019). "US charges two members of the Dridex malware gang". ZDNet. Retrieved December 8, 2019.
  10. ^ "Raspberry Robin and Dridex: Two birds of a feather". IBM. 1 September 2022. Retrieved 20 April 2025.
  11. ^ Mujezinovic, Damir (2021-09-10). "Evil Corp: A Deep Dive Into One of the World's Most Notorious Hacker Groups". MakeUseOf. Archived from the original on 2021-09-10. Retrieved 2021-11-23.
  12. ^ a b Tidy, Joe (2021-11-17). "Evil Corp: 'My hunt for the world's most wanted hackers'". BBC News. Retrieved 2021-11-23.
  13. ^ "Treasury Sanctions Evil Corp, the Russia-Based Cybercriminal Group Behind Dridex Malware". U.S. Department of the Treasury. December 5, 2019. Archived from the original on 2019-12-05. Retrieved 2021-11-23.
  14. ^ a b c d e f Burt, Jeff (2022-06-03). "Even Russia's Evil Corp now favors software-as-a-service". The Register. Retrieved 2022-06-04.
  15. ^ White, Debbie (November 17, 2021). "Hackers accused of stealing $100m live openly in Russia". The Times. ISSN 0140-0460. Retrieved 2021-11-23.
  16. ^ "Evil Corp: Behind the Screens". U.K. National Crime Agency (NCA). October 2024. Retrieved 21 April 2025.


Retrieved from "https://en.wikipedia.org/w/index.php?title=Dridex&oldid=1286716667"