Dreambot malware operation goes silent

guest · May 1, 2020

Dreambot malware operation goes silent
Dreambot backend servers have gone down and no new samples have been spotted for weeks
May 1, 2020
https://www.zdnet.com/article/dreambot-malware-operation-goes-silent/

The Dreambot malware botnet appears to have gone silent and possibly shut down, according to a report published today by the CSIS Security Group, a cyber-security firm based in Copenhagen, Denmark.

The company is reporting that the Dreambot's backend servers have gone down in March; about the same time when the cybersecurity community also stopped seeing new Dreambot samples distributed in the wild.

"The lack of new features? The multiplication of new Gozi variants? The huge rise of Zloader? [...] We can't be sure exactly what was the cause of death, but more and more indicators point at the end of Dreambot," said Benoit Ancel, malware analyst at the CSIS Security Group.
WHAT WAS DREAMBOT?
The malware's apparent death puts an end to a six-year-old "career" on the cybercrime landscape.
Dreambot was first spotted in 2014. It was created on top of the leaked source code of the older Gozi ISFB banking trojan, one of the most reused pieces of malware today.
Click to expand...

MORE THAN ONE MILLION INFECTIONS IN 2019 ALONE
CSIS says this model appears to have been successful. "We counted more than a million [Dreambot] infections worldwide just for 2019," Ancel said.

At the time of writing, Dreambot operators have not been publicly identified and remain at large. The reason for this entire cybercrime platform's current disappearance also remains a mystery.
With the operators at large, Dreambot's return remains a possibility.
Click to expand...

CSIS Security Group: The end of Dreambot? Obituary for a loved piece of Gozi.

Now, more than ever, the history of botnets is essential to have a deep understanding of the evolving cyber-crime industry. It’s time to tell some stories we learned while researching this very interesting malware operation.
What was Dreambot?
Mentioned publicly for the first time by IBM and detailed by Proofpoint and FoxIT, Dreambot was a botnet primary used to commit bank fraud.

Dreambot was using a traditional business model. You pay the administrators and they give you a C&C server, a way to protect your C&C domains [...] Starting with that, a Dreambot customer can use whatever way he wants to spread the malware and manage his victims.
Conclusions
Dreambot is a good example here as the malware is still mistaken for Ursnif even today, because of the lack of public documentation of the Gozi evolution. Moreover, Dreambot was initially considered a local problem when in fact it had world-wide reach.
Click to expand...

Log in or Sign up

Dreambot malware operation goes silent

guest Guest

Log in or Sign up

Dreambot malware operation goes silent

guest Guest

Useful Searches