Dridex is Back and Targeting the UK
Summary: After a lull following the September arrests of alleged key figures in the Dridex gang, Unit 42 observed the banking Trojan return in a major email phishing campaign using Word documents with embedded macros built by the Bartalex kit, which download a Dridex executable from a URL when opened. The campaign is heavily targeted at the United Kingdom, and as of the report only 17 of 56 VirusTotal scanners flagged the associated documents as malicious while just two recognized the implant.
What's compelling: Arrests did not end this operation: the crew's infrastructure and tooling remained viable enough to relaunch at scale, and detection coverage is thin, with only two of 56 VirusTotal engines recognizing the implant your users would be downloading.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026