Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Dridex Banking Trojan Distributed Through Word Documents

Summary: Dridex, the banking Trojan descended from Bugat/Feodo/Cridex, shifted this week from sending executable email attachments to delivering them through Microsoft Word documents loaded with macros that download and execute the malware. The first wave began October 21 with emails claiming to carry invoices from Humber Merchant's group, and WildFire detected nine distinct Word documents using the same VBA macro technique to pull executables from compromised legitimate websites.

What's compelling: Dridex's core function is stealing online banking credentials so a criminal can initiate transfers and steal funds, and its XML configuration names the login pages it targets, including accounts.google.com, login.yahoo.com, and login.live.com. Nine documents in one wave, each pulling from a different compromised legitimate site, means blocking a single URL or sender will not stop it.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related