And the winner is….Dyre Financial Trojan! According to Symantec, it has indeed become one of the biggest threat to “ordinary” financial institution (FI) customers within the past year. It beat out competitors Gameover Zeus, Shylock, and Ramnit to do this.
As a refresher, Dyre has managed to trick customers into thinking fraudulent websites are actual sites for over 1,000 financial institutions and companies worldwide. It mostly targets organizations in the U.S. and UK for its fake sites. Misspelling the web address is a common way to run into the fake sites. Criminals have thousands of registered websites with close spellings to legitimate financial institutions. It is important to never download any unsolicited update or software. If you are going to update a program, go directly to the product website. Those who become victims may have login credentials for financial institution sites stolen via Man-in-the-Middle type attacks. In addition, it may affect systems with other types of malware.
The primary infection method for Dyre, like Gameover Zeus and CryptoLocker is by phishing using spam email messages as the delivery method. These emails may masquerade as voicemail messages or fax messages that are forwarded through email, or by other types of attachments in email messages. If one of them is clicked, the user is redirected to malicious websites that install a downloader called Upatre, which attempts to steal information from the system and then disable security software before downloading Dyre.
Watch out for any type of phishing when perusing email messages. Often, they will be addressed to someone unknown to the recipient. They also may contain typos, improper use of the target language, and grammatical mistakes. Don’t open attachments in email messages unless they are from a reputable source and are expected. If in doubt, pick up the phone and call the sender to verify before clicking links or opening any type of document. Phishers have become so sophisticated these days that it is no longer just .doc or .exe files that present a risk, nor do phishing email message have to come from unknown sources.
Other ways to lower your risk are:
- Keep security software updated.
- Apply patches and updates to operating system software as soon as they are released.
- When performing financial transactions, don’t use public WiFi locations and use a previously bookmarked link that you trust whenever possible.
- If you notice anything strange about your FI’s website, don’t continue using it. Contact them to verify everything is correct before proceeding.
Symantec believes Dyre is being used by a group based in Eastern Europe or Russia. This is because much of the infrastructure to support the malware is located in those regions, but also because a relatively low number of infections seem to occur there.
For banks and credit unions
Share this article with your members
Copy a ready-made summary and link for your newsletter, website or social posts.
