Jump to content

Dridex: Difference between revisions

From Wikipedia, the free encyclopedia
Browse history interactively
← Previous editNext edit →
Content deleted Content added
VisualWikitext
update
(45 intermediate revisions by 27 users not shown)
Line 1: Line 1:
{{Short description|Computer malware}}


{{infobox computer virus
{{infobox computer virus
| Name = Dridex
| fullname = Dridex
| common_name = Dridex
* As Dridex
** Trojan:Win32/Dridex ([[Microsoft]]) <ref>{{Cite web|url=https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?|title = Cyberthreats, viruses, and malware - Microsoft Security Intelligence|website = [[Microsoft]]}}</ref>
** Trojan.Dridex ([[Malwarebytes]]) <ref>{{Cite web|url=https://blog.malwarebytes.com/detections/trojan-dridex/|title = Trojan.Dridex}}</ref>
** Trojan.Win64.DRIDEX.AD ([[Trend Micro]]) <ref>{{Cite web|url=https://www.trendmicro.com/vinfo/us/threat-encyclopedia/search/dridex|title=Search - Threat Encyclopedia}}</ref>
** W32/Dridex.ABA!tr ([[FortiGuard]])<ref>{{Cite web|url=https://fortiguard.com/encyclopedia/virus/8080330|title = Fortiguard}}</ref>

| Type = [[Trojan horse (computing)|Trojan]]
| Type = [[Trojan horse (computing)|Trojan]]
| Subtype = [[Banking trojan]]
| Subtype = Banking trojan
| Author = [[Necurs botnet|Necurs]]
| Author = [[Necurs botnet|Necurs]] [[Maksim Yakubets]]
}}
}}
⚫
'''Dridex''', also known as '''Bugat''' and '''Cridex''', is a form of [[malware]] that specializes in stealing bank credentials via a system that utilizes [[macro (computer science)|macros]] from [[Microsoft Word]].<ref>{{cite web

⚫
'''Dridex''' also known as Bugat and Cridex is a form of [[malware]] that specializes in stealing bank credentials via a system that utilizes [[macro (computer science)|macros]] from [[Microsoft Word]].<ref>{{cite web
| url=https://thehackernews.com/2016/02/botnet-antivirus.html
| url=https://thehackernews.com/2016/02/botnet-antivirus.html
| title=Someone Hijacks Botnet Network & Replaces Malware with an Antivirus
| title=Someone Hijacks Botnet Network & Replaces Malware with an Antivirus
| author=Mohit Kumar
| date=2016-02-04
| date=2016-02-04
| accessdate=2017-01-11}}</ref>
| access-date=2017-01-11}}</ref>


The targets of this malware are [[Microsoft Windows|Windows]] users who open an [[email]] attachment in Word or [[Microsoft Excel|Excel]], causing macros to activate and download Dridex, infecting the computer and opening the victim to banking theft.
The targets of this malware are [[Microsoft Windows|Windows]] users who open an [[email]] attachment in Word or [[Microsoft Excel|Excel]], causing macros to activate and download Dridex, infecting the computer and opening the victim to banking theft.
Line 22: Line 29:
| date=2016-01-19
| date=2016-01-19
| website=[[PCWorld]]
| website=[[PCWorld]]
| accessdate=2017-01-11}}</ref> from users of infected machines to immediately launch [[bank fraud|fraudulent transactions]]. Bank information for the software installs a keyboard listener and performs [[injection attack]]s. During 2015, theft caused by this software were estimated at £20 million in the United Kingdom and $10 million in the United States. By 2015, Dridex attacks had been detected in more than 20 countries. In early September 2016, researchers spotted initial support for targeting crypto-currency wallets.<ref>{{Cite web
| access-date=2017-01-11}}</ref> from users of infected machines to immediately launch [[bank fraud|fraudulent transactions]]. Bank information for the software installs a keyboard listener and performs [[injection attack]]s. During 2015, theft caused by this software was estimated at £20 million in the United Kingdom and $10 million in the United States. By 2015, Dridex attacks had been detected in more than 20 countries. In early September 2016, researchers spotted initial support for targeting [[cryptocurrency]] wallets.<ref>{{Cite web
| url=http://news.softpedia.com/news/dridex-banking-trojan-will-soon-target-crypto-currency-wallets-508041.shtml
| url=http://news.softpedia.com/news/dridex-banking-trojan-will-soon-target-crypto-currency-wallets-508041.shtml
| title=Dridex Banking Trojan Will Soon Target Crypto-Currency Wallets
| title=Dridex Banking Trojan Will Soon Target Crypto-Currency Wallets
Line 28: Line 35:
| date=2016-09-07
| date=2016-09-07
| website=[[Softpedia]]
| website=[[Softpedia]]
| accessdate=2017-01-11}}</ref>
| access-date=2017-01-11}}</ref>

In December 2019, US authorities filed charges against two suspects believed to have created the Dridex malware, including the group's alleged leader.<ref>{{Cite web|url=https://www.zdnet.com/article/us-charges-two-members-of-the-dridex-malware-gang/|title=US charges two members of the Dridex malware gang|last=Cimpanu|first=Catalin|date=December 5, 2019|website=ZDNet|access-date=December 8, 2019}}</ref>

==Evil Corp==
'''Evil Corp''' ({{Also known as}} '''Dridex''' and '''INDRIK SPIDER''') is a Russian [[Hacker|hacking]] group that has been active since 2009.<ref>{{Cite web|last=Mujezinovic|first=Damir|date=2021-09-10|title=Evil Corp: A Deep Dive Into One of the World's Most Notorious Hacker Groups|url=https://www.makeuseof.com/a-look-at-evil-corp/|url-status=live|access-date=2021-11-23|website=[[MakeUseOf]]|language=en-US|archive-url=https://web.archive.org/web/20210910132807/https://www.makeuseof.com/a-look-at-evil-corp/ |archive-date=2021-09-10 }}</ref> In 2019, the [[Federal Bureau of Investigation]] (FBI) named nine alleged members of the group, accusing them of [[Extortion|extorting]] or [[Theft|stealing]] over $100,000,000 through hacks that affected 40 countries.<ref name=":0">{{Cite news|last=Tidy|first=Joe|date=2021-11-17|title=Evil Corp: 'My hunt for the world's most wanted hackers'|language=en-GB|work=[[BBC News]]|url=https://www.bbc.com/news/technology-59297187|access-date=2021-11-23}}</ref> The [[United States Department of the Treasury]] additionally imposed [[Sanctions (law)|sanctions]] against the group.<ref>{{Cite web|date=December 5, 2019|title=Treasury Sanctions Evil Corp, the Russia-Based Cybercriminal Group Behind Dridex Malware|url=https://home.treasury.gov/news/press-releases/sm845|url-status=live|access-date=2021-11-23|website=[[U.S. Department of the Treasury]]|language=en|archive-url=https://web.archive.org/web/20191205162245/https://home.treasury.gov/news/press-releases/sm845 |archive-date=2019-12-05 }}</ref> In November 2021, the [[British Broadcasting Company]] published an [[Investigative journalism|investigation]] which found that the two alleged leaders of the group were living openly in Russia.<ref name=":0" /><ref>{{Cite news|last=White|first=Debbie|date=November 17, 2021|title=Hackers accused of stealing $100m live openly in Russia|language=en|work=[[The Times]]|url=https://www.thetimes.co.uk/article/evil-corp-hackers-accused-of-stealing-100m-live-openly-in-russia-fcxw7qcnk|access-date=2021-11-23|issn=0140-0460}}</ref>

In June of 2022, [[Mandiant]] reported that Evil Corp was using off-the-shelf ransomware, such as [[LockBit]], to conceal their identity and evade sanctions.<ref name=tr-even-russias-evil-corp-favours-saas>{{Cite news |title=Even Russia's Evil Corp now favors software-as-a-service |url=https://www.theregister.com/2022/06/03/evil-corp-ransomware-sanctions/ |last=Burt |first=Jeff |date=2022-06-03 |access-date=2022-06-04 |work=[[The Register]]}}</ref> The [[Office of Foreign Assets Control]] sanctioned Evil Corp in December 2019 over development and use of Dridex malware.<ref name=tr-even-russias-evil-corp-favours-saas/> People in the United States were banned from "engaging in transactions" with Evil Corp.<ref name=tr-even-russias-evil-corp-favours-saas/> People outside the US may be subject to secondary sanctions for knowingly facilitating significant transactions with Evil Corp.<ref name=tr-even-russias-evil-corp-favours-saas/> The US government also charged two members of the gang and offered a reward of $5 million dollars.<ref name=tr-even-russias-evil-corp-favours-saas/>

Mandiant has linked the group to threat actor UNC2165.<ref name=tr-even-russias-evil-corp-favours-saas/>

Emsisoft analysts said in December 2021 that they suspected a ransomware infection in which REvil was a suspect was in fact the work of Evil Corp.<ref name=tr-even-russias-evil-corp-favours-saas/>


==See also==<!-- PLEASE RESPECT ALPHABETICAL ORDER -->
==See also==<!-- PLEASE RESPECT ALPHABETICAL ORDER -->
Line 44: Line 62:
{{Reflist|30em}}
{{Reflist|30em}}



⚫
[[Category:Malware]]
{{authority control}}{{Hacking in the 2020s}}
{{Hacking in the 2010s}}

[[Category:2015 in computing]]
[[Category:Windows trojans]]
[[Category:Cyberattacks on banking industry]]
[[Category:Hacking in the 2020s]]
[[Category:2009 establishments in Russia]]
[[Category:Russian entities subject to U.S. Department of the Treasury sanctions]]
[[Category:Extortionists]]
⚫
[[Category:Ransomware]]

Revision as of 15:14, 24 June 2024

Dridex
TypeTrojan
SubtypeBanking trojan
AuthorsNecurs Maksim Yakubets

Dridex, also known as Bugat and Cridex, is a form of malware that specializes in stealing bank credentials via a system that utilizes macros from Microsoft Word.[5]

The targets of this malware are Windows users who open an email attachment in Word or Excel, causing macros to activate and download Dridex, infecting the computer and opening the victim to banking theft.

The primary objective of this software is to steal banking information[6] from users of infected machines to immediately launch fraudulent transactions. Bank information for the software installs a keyboard listener and performs injection attacks. During 2015, theft caused by this software was estimated at £20 million in the United Kingdom and $10 million in the United States. By 2015, Dridex attacks had been detected in more than 20 countries. In early September 2016, researchers spotted initial support for targeting cryptocurrency wallets.[7]

In December 2019, US authorities filed charges against two suspects believed to have created the Dridex malware, including the group's alleged leader.[8]

Evil Corp

Evil Corp (a.k.a. Dridex and INDRIK SPIDER) is a Russian hacking group that has been active since 2009.[9] In 2019, the Federal Bureau of Investigation (FBI) named nine alleged members of the group, accusing them of extorting or stealing over $100,000,000 through hacks that affected 40 countries.[10] The United States Department of the Treasury additionally imposed sanctions against the group.[11] In November 2021, the British Broadcasting Company published an investigation which found that the two alleged leaders of the group were living openly in Russia.[10][12]

In June of 2022, Mandiant reported that Evil Corp was using off-the-shelf ransomware, such as LockBit, to conceal their identity and evade sanctions.[13] The Office of Foreign Assets Control sanctioned Evil Corp in December 2019 over development and use of Dridex malware.[13] People in the United States were banned from "engaging in transactions" with Evil Corp.[13] People outside the US may be subject to secondary sanctions for knowingly facilitating significant transactions with Evil Corp.[13] The US government also charged two members of the gang and offered a reward of $5 million dollars.[13]

Mandiant has linked the group to threat actor UNC2165.[13]

Emsisoft analysts said in December 2021 that they suspected a ransomware infection in which REvil was a suspect was in fact the work of Evil Corp.[13]

See also

References

  1. ^ "Cyberthreats, viruses, and malware - Microsoft Security Intelligence". Microsoft.
  2. ^ "Trojan.Dridex".
  3. ^ "Search - Threat Encyclopedia".
  4. ^ "Fortiguard".
  5. ^ "Someone Hijacks Botnet Network & Replaces Malware with an Antivirus". 2016-02-04. Retrieved 2017-01-11.
  6. ^ Jeremy Kirk (2016-01-19). "Dridex banking malware adds a new trick". PCWorld. Retrieved 2017-01-11.
  7. ^ Catalin Cimpanu (2016-09-07). "Dridex Banking Trojan Will Soon Target Crypto-Currency Wallets". Softpedia. Retrieved 2017-01-11.
  8. ^ Cimpanu, Catalin (December 5, 2019). "US charges two members of the Dridex malware gang". ZDNet. Retrieved December 8, 2019.
  9. ^ Mujezinovic, Damir (2021-09-10). "Evil Corp: A Deep Dive Into One of the World's Most Notorious Hacker Groups". MakeUseOf. Archived from the original on 2021-09-10. Retrieved 2021-11-23.
  10. ^ a b Tidy, Joe (2021-11-17). "Evil Corp: 'My hunt for the world's most wanted hackers'". BBC News. Retrieved 2021-11-23.
  11. ^ "Treasury Sanctions Evil Corp, the Russia-Based Cybercriminal Group Behind Dridex Malware". U.S. Department of the Treasury. December 5, 2019. Archived from the original on 2019-12-05. Retrieved 2021-11-23.
  12. ^ White, Debbie (November 17, 2021). "Hackers accused of stealing $100m live openly in Russia". The Times. ISSN 0140-0460. Retrieved 2021-11-23.
  13. ^ a b c d e f g Burt, Jeff (2022-06-03). "Even Russia's Evil Corp now favors software-as-a-service". The Register. Retrieved 2022-06-04.


Retrieved from "https://en.wikipedia.org/w/index.php?title=Dridex&oldid=1230759998"