Threat Spotlight: Dyre/Dyreza: An Analysis to Discover the DGA
Summary: Cisco Talos analyzed the Dyre banking trojan, which spreads through phishing emails with fake fax attachments that install an Upatre variant to download and execute Dyre, then hooks the victim's browser to steal bank credentials and exfiltrate them to attacker-controlled command and control servers. The latest Dyre versions replaced hardcoded C2 URLs with a domain generation algorithm that produces 333 possible domains per day from a year-month-day string and a number in the range [0, 333), hashed with SHA256 and paired with a TLD lookup table over SSL on port 443.
Key Takeaway: Because Dyre changes its command and control domain daily and picks from 333 candidates, blocklists built on observed domains cannot keep up - which is why Talos reverse engineered the DGA to enumerate and block the full daily set before a compromised user's credentials leave the network.
Read the original at Cisco Talos ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026