Threat Spotlight: Spam Served With a Side of Dridex
Summary: Cisco Talos researchers identified a Dridex banking trojan spam campaign that lasted less than five hours and used unique sender addresses, subjects, and attachment names for each message, with fewer than five percent of emails reusing an attachment name. The attached Word documents ran macros that used cmd.exe and PowerShell to download and execute a Dridex variant from five unique hard-coded IP addresses, and the dropped file copied itself to %AppData%, created a mutex, and connected to C2 servers over port 8080.
What you should know: Anti-virus detection for the Word documents only caught up at the tail end of the five-hour campaign, and outbreak filters bought just 0.6 hours of lead time for the first campaign and 3.3 hours for the second - a window that closes faster than most security teams can react.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026