Online Banking Malware Installs Without User Permission

It’s back at it after only being seen recently for small attacks. Dridex, the Banking Trojan that seeks to access financial accounts and steal funds has been modified to bypass some Windows features that are supposed to prevent execution of such malware. This is what researchers at Flashpoint discovered recently. While not known if it’s widespread yet, it’s worth paying attention to its actions.

So far, it has worked on Windows 7 by bypassing User Account Controls (UAC), which normally require a user to click something to allow a file to execute. It works if the user has administrator rights. It is suspected it won’t work if the user has limited rights, as the attack does not escalate privileges itself. While it is presumed to work on Windows 10, that has not been confirmed.

Dridex makes its way onto a system when a user opens a Word attachment that arrives in a spam email. It uses macros, so if the user enables the macros, Dridex will execute on the system and the user is none-the-wiser, as everything happens in the background.

It is recommended that macros be disabled by default. In newer versions of Windows, this is the case out of the box. However, some older versions of Microsoft Office have them enabled by default. Check to make sure your version has them turned off. Most documents don’t require macros, so it’s not usually necessary to enable them. If you receive a document that requests them and you are not expecting that, you should be suspicious.

Dridex is one of the top five pieces of malware used to access financial accounts. It is the fourth of the most encountered banking trojans and accounts for 11% of all financial malware, per IBMs X-Force. Zeus takes the number 1 spot and is followed by Neverquest and Gozi, respectively. Malware that is based on Zeus accounts for 28% of the top malware threats.

Members of the SWIFT (Society for Worldwide Interbank Financial Communication) network are increasingly targeted by financially focused malware, as the use of SWIFT rises. The network that provides secure messaging services among its members now has nearly 11,300 customers and carries over 5 billion messages per year. According to its website, its message rate has increased nearly 6% already in 2017. Unfortunately, one of its customers, Bangladesh Central Bank was a victim of cyber thieves. They stole $81 million in February of 2017 by going through a member institution.