Dyreza Malware: Branching Into Supply-Chain

Cyber criminals are on the move, diversifying from financial data theft to supply chain industrial malware. A computer trojan called Dyreza, was originally created to steal online banking information. Since its inception, Dyreza has developed into a successful tool for hijacking data beyond the financial realm. Its new focus is stealing credentials along the supply chain of manufacturing, often in the warehouse, distribution, and fulfillment businesses. A blog post from security research firm, Proofpoint, stated “This represents a deliberate strategy on the part of attackers to target new industries at all points across the supply chain.” Their targets have included Apple, Shopify, and Iron Mountain.

Often appearing as a Man-in-the-Browser (MITB) trojan, Dyreza was commonly used for attacks on financial data. That focus has changed. One popular and effective campaign Dyreza uses to reach its new goal starts in the shape of an email. 

Most of the emails look like a secure message from a financial institution, hopefully enticing the reader to reply. These emails contain a Microsoft Word document as an attachment. The attachment contains legitimate-looking encrypted code and asks the recipient to click on a button that would enable them to read the message. Once the attachment is opened, Dyreza is off to the races downloading and installing the trojan.

Again, email phishing is the means of getting this malware out and about. So always keep the signs in mind when reading email messages; even those from people you trust.

• Don’t reply to messages that trigger any suspicion. Instead, separately type an email to the sender if you must respond. However, a phone call is even better.
• It is highly unlikely that any financial institution would ask you to open an attachment to read an important message. Instead, they will let you know to log into your account and check in your message center.
• Look for misspelled words, incorrect use of the language in which the messages is written, and poor grammar.
• Pay attention to logos used in the messages. Cyber criminals are becoming more adept at copying logos of well-known companies to make them appear more legitimate, so look closely at images.
• If there is an attachment, make sure it is expected. If not, place a call to the sender to verify. If in doubt, don’t open it.
• Manually type links into the browser address bar.  Before doing that, let the mouse pointer hover over them to make sure it is for a site that makes sense. Again, it's better to place a phone call to the sender to make sure the link was intended.
• Never type confidential information such as login credentials into anything that gets sent via email. Most email is not secured and traverses the Internet in plain text.

Proofpoint also states that “Once an attacker has obtained login credentials for their targeted systems, the potential to harvest payment information, make fraudulent financial transfers, and even divert physical shipments is immense.” So stay on top of educating yourself and those around you to avoid becoming the next malware victim or putting your organization at risk.