Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


12:45 PM
Sara Peters
Sara Peters
Quick Hits
Connect Directly

In Wake Of Resurgence, US-CERT Issues Alert About Dridex

U.S. issues alert about banking Trojan, but recent attacks focus on U.K.

US-CERT issued a technical alert about the Dridex banking Trojan today, about two weeks after the malware was found being used in a large phishing campaign heavily targeted at users in the United Kingdom.

Palo Alto Networks reported they saw this campaign after witnessing a brief decrease in Dridex activity in September, following the arrest of a Moldovan man purported to be a key player in a cybercrime gang that used Dridex.

Dridex typically spreads through phishing messages with malicious Microsoft Office documents attached; those documents trick users into enabling macros, which then call out to attacker-controlled sites, which download the Dridex Trojan. The decoys used in the latest campaign were Word documents pretending to be invoices.

As the US-CERT alert states, "The primary goal of Dridex is to infect computers, steal credentials, and obtain money from victims’ bank accounts. ... Once a computer has been infected, Dridex is capable of stealing user credentials through the use of surreptitious keystroke logging and web injects."

Although this alert is being issued by American authorities, Dridex has previously shown particular interest in British targets. Last month, the British GCHQ issued alerts after Fujitsu stumbled upon a Dridex "hitlist" of 385 million addresses, mostly in the UK. Dridex attacks last year -- the "Peter Pan" attacks of September 2014 -- also focused on the U.K, specifically small- to medium-sized businesses.

For more information, see the US-CERT alert, and research at Zscaler or FireEye.   

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 6/5/2020
How AI and Automation Can Help Bridge the Cybersecurity Talent Gap
Peter Barker, Chief Product Officer at ForgeRock,  6/1/2020
Cybersecurity Spending Hits 'Temporary Pause' Amid Pandemic
Kelly Jackson Higgins, Executive Editor at Dark Reading,  6/2/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: What? IT said I needed virus protection!
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-06-06
SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.
PUBLISHED: 2020-06-05
The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from a stored XSS vulnerability. An author user can create posts that result in a stored XSS by using a crafted payload in custom links.
PUBLISHED: 2020-06-05
The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from multiple stored XSS vulnerabilities. An author user can create posts that result in stored XSS vulnerabilities, by using a crafted link in the custom URL or by applying custom attributes.
PUBLISHED: 2020-06-05
In Combodo iTop a menu shortcut name can be exploited with a stored XSS payload. This is fixed in all iTop packages (community, essential, professional) in version 2.7.0 and iTop essential and iTop professional in version 2.6.4.
PUBLISHED: 2020-06-05
In Combodo iTop, dashboard ids can be exploited with a reflective XSS payload. This is fixed in all iTop packages (community, essential, professional) for version 2.7.0 and in iTop essential and iTop professional packages for version 2.6.4.