Dridex Is Back, then it's gone again
Summary: Cisco Talos reported a resurgence of Dridex email campaigns starting the week of December 4th, using malicious Word and Excel attachments that rely on Microsoft Office macros to install malware that steals online banking credentials. Talos analyzed three campaigns distinguishable by subject line - "Industrial Invoices" (about 2 hours on December 4th), "Remittance Advice for 907.62 GBP" (about 2.5 hours on December 4th), and "INVOICE 224245 from Power EC Ltd" (about 9 hours on December 7th) - with the first and third repeating similar campaigns from November 13th and November 12th respectively.
Key Takeaway: Despite attack windows as short as 2 hours, Talos's sensors picked up very large volumes of malicious messages, indicating the Dridex spam-sending botnet is very large - and reputation systems will likely miss the first few seconds to minutes of each burst.
Read the original at Cisco Talos ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026