They’re cute, cuddly, found in zoos, and in China. Now they may also be found infecting your computer. What is being referred to as Panda Banker, takes advantage of vulnerabilities in Microsoft Office and is yet another iteration of the infamous Zeus family of malware (which includes Dridex and Cridex). This close knit family of malware has stolen hundreds of millions, or even billions of dollars from victims' online bank accounts. The little “Panda” may also trick victims into activating macros and weaponizing Microsoft Word to do its dirty work.
There are a several lessons here. First, patches have been available for these vulnerabilities for a couple of years. They are CVE-2014-1761 or CVE-2021-0158. Therefore, if you are one of those people who just never seems to get around to applying these fixes, now is a great time to do that. If you have to put a reminder on your calendar to check for patches weekly or monthly, it’s worth the effort. Even better: Activate automatic updates and you won’t have to worry about it. Keeping all of your computers and mobile devices updated is important to make sure the cyber criminals do not continue to exploit these holes. When you see that an update is available, take a look and apply security and critical patches right away. If your devices are no longer supported (such as those running Windows XP or OS X 10.6 Snow Leopard), then seriously consider getting newer versions so that you can keep them up-to-date.
Second, macros should be disabled by default in Microsoft Office. If you never changed it, there is a good chance this is still the case. However, sometimes it may be necessary to enable them. If you have done this at any point, go in and check it to make sure the software must ask before enabling them. When something does ask, use caution in allowing them to run. Newer versions of the software have this set when it’s installed, but if you are using an older version, it may not be that way.
Third, be 100% sure that any file you open is safe. If you have any doubts, don’t do it until you can be sure. Phishing is still the top way cyber criminals steal information so it’s always of the utmost importance to know what you’re opening or clicking.
Lastly, always have anti-malware software installed on all devices. These may not catch everything, but they will catch most everything. Keep this software updated too. Most of them have a setting that allows it to update automatically. It’s recommended to do this so you don’t get distracted and forget.
Remember that looks and names can be deceiving. Just because it looks or sounds cute, doesn’t mean it’s harmless. In fact, no human would be a match physically for a panda if it feels threatened. In fact, in 2006 a drunken showoff climbed into a panda enclosure and was carried out by medical personnel with a barely recognizable leg after the bear got to him. And cyber criminals who want your information will do something similar. It is just likely to be in the form of a phishing hook or some sweet-talking social engineering tactic, rather than teeth or claws.
For banks and credit unions
Share this article with your members
Copy a ready-made summary and link for your newsletter, website or social posts.
