Dridex Trojan is Phishing for New Accounts, Don't Let Yours be One of Them

In 2015, a malware strain called Dridex was hitting Europe. Its mission was to infect online banking users’ computers and steal their login credentials. Unfortunately, it has a new mission that has led it to the United States.

It is spread through phishing email messages containing a Microsoft Word document that has malicious macros inside. It infects the targeted system, steals online banking credentials, and then redirects to fake webpages with the victims none-the-wiser.

According to cybersecurity company F5, Dridex remotely connects to an infected PC and then initiates fraudulent online payments and other financial transactions.

Because it uses macro functionality, make sure macros are disabled by default on your computer.  Microsoft does this for you on installation of Microsoft Word, but make sure it still remains that way on your version. Some older versions did not do this. Always make sure you are certain that you need to enable macros on a document. Most of the time, you don’t; so if an attachment asks you to, take some time to verify that it’s legitimate before clicking the OK button.

For online banking, take advantage of any multi-factor authentication your financial institution offers. Sometimes this will be a text or email message that gets sent to you with a randomly generated number that must be entered before access is granted. It may also be a key fob that has those randomly generated access codes. It could also be a call back from an automated phone system. Whatever it may be, activate it for added account security.

Always be cautious when clicking links or opening any attachments in email messages. Phishing is a very successful method for cybercriminals to get information that can be used for fraud. Take some time to confirm any message that asks you to open something, click something, or enter any sensitive information.

Some security experts believe that cyber criminals test their methods in Europe before trying them in the United States. The ultimate targets are more often becoming corporations, because corporate bank accounts are much larger payouts. The values originally stolen by Dridex (an evolution of Cridex, which evolved from Zeus), were from UK customers and reached up to seven figures. At its peak, the number of spam messages sent that contained Dridex was 15,000 per day.

In late 2015, global law enforcement took down a botnet that was used to distribute Dridex. At that time, it was estimated that the malware was responsible for over $40 million in account takeover losses.