Dridex Banking Trojan Uses Weapon of Mass Destruction to Thwart Security and Steal From You

Our old pal, the Dridex banking trojan is back and is new and improved and now considered one of the most dangerous of its type. Several new features have been added or improved upon in this version 4, and per IBM X-Force, the significance of this one is that it continues to “evolve in sophistication, investing in further efforts to evade security and enhance its capabilities to enable financial fraud.”

One of the upgrades this time is that it uses a technique called AtomBombing.  This was first noticed back in October of 2016. It works by using code injection techniques in order to exploit Windows atom tables and Async Procedure Calls (APC). For the non-technical, suffice it to say that by doing this the malware can bypass some common security solutions.

This does not mean that it’s time to get lazy about updating security software and applying patches. It does mean that it’s more important than ever to continue doing this. Although the hackers seem to be one step ahead of the good guys, there is a good chance that by keeping up good security habits and updating software, the risk of getting hit by this is considerably lower.

Dridex is banking malware that uses macros to trick unsuspecting users into enabling those in Microsoft Office files. It then can infect systems. Once it succeeds, it can steal personal information that resides on the system, as well as online banking credentials and send it all back to the attackers.

Because it does infect using macros, always make sure those are disabled in your Microsoft Office software, both at home and at work. If you do receive email with a file of any type attached that asks you to enable them, it should be met with considerable suspicion. Most people don’t often come across macros in their files. If you don’t normally encounter them, didn’t create the macros in a document, or don’t know who did, confirm with the sender of the email that it was intended for you to receive and open it. Do this by calling him or her, by using texts, or by making a personal visit. In other words, don’t simply reply back to the email message. Hackers often spoof the email address and replies are often monitored by the attackers.

This latest and “greatest” version of Dridex is currently targeting British banks. However, it is suspected and there are indications that it’s moving toward the US. Likely it will quickly make its way around the globe.