Dridex banking malware spread through malicious phishing campaigns

guest · Dec 24, 2021

Dridex malware trolls employees with fake job termination emails
December 22, 2021

A new Dridex malware phishing campaign is using fake employee termination emails as a lure to open a malicious Excel document, which then trolls the victim with a season's greeting message.

Dridex is a banking malware spread through malicious emails that was initially developed to steal online banking credentials. Over time, the developers evolved the malware to use different modules that provide additional malicious behavior, such as installing other malware payloads, providing remote access to threat actors, or spreading to other devices on the network.
Click to expand...

Dridex affiliate trolls researchers, victims
A Dridex affiliate has been conducting numerous malicious email campaigns over the past few weeks where they troll researchers with email addresses and filenames composed of racist and antisemitic words.

A security researcher known as TheAnalyst discovered that Dridex is again trolling people, but this time it's the victims who are being sent fake employee termination emails.
Click to expand...

Once Dridex is launched, it will begin installing additional malware, stealing credentials, and performing other malicious behavior.

Therefore, if you receive an email stating you are fired right before Christmas, be sure to reach out to your human resources department or employer before opening the email.
Click to expand...

As Dridex infections commonly lead to ransomware attacks, Windows admins need to stay on top of the latest malware distribution methods and train employees on how to spot them as well.
Click to expand...

guest · Dec 24, 2021

Dridex Omicron phishing taunts with funeral helpline number
December 24, 2021

A malware distributor for the Dridex banking malware has been toying with victims and researchers over the last few weeks. The latest example is a phishing campaign that taunts victims with a COVID-19 funeral assistance helpline number.

Once installed, Dridex will attempt to steal online banking credentials, spread to other machines, and potentially provide remote network access for ransomware attacks.
Click to expand...

COVID-19 Omnicron variant used as a lure
Over the past few weeks, one of the Dridex phishing email distributors is having fun toying with victims and researchers.
Earlier this week, the threat actor spammed fake employee termination letters that displayed an alert stating, "Merry X-Mas Dear Employees!", after infecting their device.

In a new phishing campaign discovered by MalwareHunterTeam and 604Kuzushi, this same threat actor took it to the next level by spamming emails with a subject of "COVID-19 testing result" that states the recipient was exposed to a coworker who tested positive to the Omicron COVID-19 variant.
To add insult to injury, after macros are enabled, and the device becomes infected, the threat actor taunts their victims by displaying an alert containing the phone number for the "COVID-19 Funeral Assistance Helpline."
Click to expand...

As Dridex phishing campaigns are currently using password-protected attachments, enterprises need to train their employees to spot and avoid these types of attacks.

As always, if you receive unexpected emails or one that contains unusual attachments, always reach out to your network admin or other people in the workplace to determine if the email is legitimate.
Click to expand...

Log in or Sign up

Dridex banking malware spread through malicious phishing campaigns

guest Guest

guest Guest

Log in or Sign up

Dridex banking malware spread through malicious phishing campaigns

guest Guest

guest Guest

Useful Searches