Dridex

Malware updated 23 days ago (2024-11-29T14:03:36.830Z)

Download STIX

Preview STIX

Dridex is a notorious malware, specifically a banking Trojan, designed to exploit and damage computer systems, often infiltrating through suspicious downloads, emails, or websites. This malicious software was primarily used by the Russian cybercriminal group, Evil Corp, founded in 2014. The group targeted banks and financial institutions across more than 40 countries, leading to criminal profits exceeding $100 million. Dridex was also linked to BitPaymer ransomware, another tool in Evil Corp's arsenal. The group's leader, Maksim Yukabets, allegedly used the substantial profits from Dridex to fund a lavish lifestyle, including the purchase of a Lamborghini. Throughout 2020, as the Ransomware as a Service (RaaS) model gained traction, connections between first-stage malware like Dridex and subsequent ransomware attacks became evident. Dridex operators employed DLL side-loading, a technique involving hijacking legitimate Windows executables, which necessitated multiple detection analytics for effective cybersecurity. The malware created randomly-named directories under random directory paths, copied legitimate Microsoft executables, and renamed the Dridex DLL.tmp files for the DLL side-loading. This method was not exclusive to Dridex but was also used by other state-sponsored actors and cybercrime industries, such as Lazarus Group and Tropic Trooper. Evil Corp faced significant setbacks following US sanctions in 2019, which exposed the inner workings of the group and its association with the FSB, Russia's security agency. The sanctions also revealed the identity of Yakubets and his familial connections within Evil Corp. Despite these disruptions, Dridex remained prevalent and was observed alongside other botnet families such as Emotet, IcedID, QakBot, and TrickBot, all of which had high C2 detections within the year. As of now, despite the challenges, Dridex continues to be a significant threat in the cybercrime landscape.

Description last updated: 2024-10-02T21:15:55.928Z

What's your take? (Question 1 of 5)

Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.

Possible Aliases / Cluster overlaps

It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at. Create a free account to see the source evidence for each alias, and help fix any errors.

Alias Description	Votes
Zeus is a possible alias for Dridex. Zeus is a notorious malware, short for malicious software, designed to exploit and damage computer systems. It is often spread through suspicious downloads, emails, or websites and can infiltrate systems without the user's knowledge. Once inside, it can steal personal information, disrupt operations	3
Gandcrab is a possible alias for Dridex. GandCrab, a threat actor, is known for its malicious activities involving ransomware attacks. Originating from Russian origins and evolving from Team Truniger, a former GandCrab affiliate, the group has been linked to numerous ransomware variants including Bad Rabbit, LockBit 2.0, STOP/DJVU, and REv	2

Miscellaneous Associations

Other elements of context that could aid in the identification of relevance

Malware

Trojan

Ransomware

Cybercrime

Botnet

Spam

Loader

Lateral Move...

Fraud

Bot

Payload

Macos

Antivirus

Extortion

Exploit

Russia

Infostealer

Analyst Notes & Discussion

Be the first to leave your mark here! Log in to share your views and vote.

Associated Malware

To see the evidence that has resulted in these malware associations, create a free account

Alias Description	Association Type	Votes
The Emotet Malware is associated with Dridex. Emotet is a notorious malware, short for malicious software, that is designed to exploit and damage computers or devices. It can infiltrate systems through suspicious downloads, emails, or websites, often unbeknownst to the user, with the potential to steal personal information, disrupt operations,	Unspecified	6
The BitPaymer Malware is associated with Dridex. BitPaymer is a type of malware, specifically ransomware, that was operated by the cybercriminal group known as GOLD DRAKE. It is designed to infiltrate systems and encrypt data, holding it hostage until a ransom is paid. This malicious software became prominent in conjunction with the rise of Ransom	Unspecified	5
The IcedID Malware is associated with Dridex. IcedID is a malicious software (malware) that has been implicated in numerous cybercrime campaigns. It has been associated with other notable malware such as Qakbot, BazarLoader, CobaltStrike, Conti, Gozi, Trickbot, Quantum, Emotet, Pikabot, and SystemBC. Its distribution often involves the use of d	Unspecified	4
The TrickBot Malware is associated with Dridex. TrickBot is a notorious malware developed by cybercriminals to exploit and damage computer systems, often infiltrating through suspicious downloads, emails, or websites. This malicious software can steal personal information, disrupt operations, or even hold data hostage for ransom. Vladimir Dunaev,	Unspecified	3
The Doppelpaymer Malware is associated with Dridex. DoppelPaymer is a type of malware, specifically ransomware, that was initially developed and operated by the GOLD DRAKE threat group under the name BitPaymer. The software was later reworked and renamed to DoppelPaymer by another threat group, GOLD HERON. This malicious software first appeared in mi	Unspecified	3
The QakBot Malware is associated with Dridex. Qakbot is a type of malware, or malicious software, that infiltrates computer systems to exploit and damage them. This harmful program can infect devices through suspicious downloads, emails, or websites, often without the user's knowledge. Once inside, it can steal personal information, disrupt ope	Unspecified	3
The Ursnif Malware is associated with Dridex. Ursnif, also known as Gozi or ISFB, is a type of malware that has been distributed by threat actor group TA551. This harmful software can infiltrate systems via suspicious downloads, emails, or websites, and once inside, it can steal personal information, disrupt operations, or even hold data for ra	Unspecified	2
The Gozi Malware is associated with Dridex. Gozi is a notorious malware that has been linked to numerous cyber attacks. It's typically delivered through sophisticated malvertising techniques, often used in conjunction with other initial access malware such as Pikabot botnet agent and IcedID information stealer. When an individual accesses a c	Unspecified	2
The Gameover Zeus Malware is associated with Dridex. GameOver Zeus is a variant of the ZeuS malware, used by malicious actors to steal banking credentials and distribute other types of malware, including ransomware such as Cryptolocker. It operated as a banking Trojan, infecting systems and stealing sensitive information. The botnet was closely associ	Unspecified	2
The Raccoon Malware is associated with Dridex. Raccoon is a malicious software (malware) developed by Russian-speaking coders, first spotted in April 2019. It was designed to steal sensitive data such as credit card information, email credentials, cryptocurrency wallets, and more from its victims. The malware is offered as a service (MaaS) for $	Unspecified	2

Associated Threat Actors

To see the evidence that has resulted in these threatActor associations, create a free account

Alias Description	Association Type	Votes
The Evil Corp Threat Actor is associated with Dridex. Evil Corp, a threat actor based in Russia, has been identified as a significant cybersecurity threat due to its involvement in various malicious activities, including the deployment of Dridex malware. The group is led by Maksim Yakubets and has been sanctioned by the Treasury Department for its cybe	Unspecified	5
The TA505 Threat Actor is associated with Dridex. TA505, also known as Cl0p Ransomware Gang and Lace Tempest, is a highly active and sophisticated cybercriminal group. The group has been associated with various high-profile cyber-attacks, demonstrating adaptability through a multi-vector approach to their operations. In June 2023, the U.S. Cybersec	Unspecified	4
The Indrik Spider Threat Actor is associated with Dridex. Indrik Spider is a notable threat actor known for its cybercriminal activities, particularly in the realm of ransomware. In July 2017, the group entered the targeted ransomware sphere with BitPaymer, using file-sharing platforms to distribute the BitPaymer decryptor. This shift in operations saw Ind	Unspecified	2
The fin11 Threat Actor is associated with Dridex. FIN11, a threat actor group also known as Lace Tempest or TA505, has been linked to the development and deployment of Cl0p ransomware. This malicious software is believed to be a variant of another ransomware, CryptoMix, and is typically used by FIN11 to encrypt files on a victim's network after ste	Unspecified	2

Source Document References

Information about the Dridex Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more

Source Link	CreatedAt	Title
BankInfoSecurity	3 months ago	Cybercrime is Still Evil Incorporated, But Disruptions Help
DARKReading	3 months ago	LockBit Associates Arrested, Evil Corp Bigwig Outed
InfoSecurity-magazine	3 months ago	Evil Corp's LockBit Ties Exposed in Latest Phase of Operation Cronos
BankInfoSecurity	3 months ago	LockBit and Evil Corp Targeted In Anti-Ransomware Crackdown
Checkpoint	3 months ago	10 Years of DLL Hijacking, and What We Can Do to Prevent 10 More - Check Point Research
Unit42	10 months ago	Intruders in the Library: Exploring DLL Hijacking
Checkpoint	10 months ago	Maldocs of Word and Excel: Vigor of the Ages - Check Point Research
CERT-EU	a year ago	One paid out, one did not • The Register \| #hacking \| #cybersecurity \| #infosec \| #comptia \| #pentest \| #ransomware \| National Cyber Security Consulting
CERT-EU	a year ago	Log4Shell: A Persistent Threat to Cybersecurity - Two Years On - Cybersecurity Insiders
CERT-EU	a year ago	Are DarkGate and PikaBot the new QakBot?
CERT-EU	a year ago	Latest RAT attack surge bypasses Microsoft's XLL block
CERT-EU	a year ago	DG NCA Graeme Biggar delivers RUSI's 4th Annual Security Lecture
MITRE	2 years ago	Tricks of the Trade: A Deeper Look Into TrickBot's Machinations
CERT-EU	a year ago	Update: The 2023 Malware League Table
CERT-EU	a year ago	Insider Threat Awareness Month: Protecting Your Business from Within
CERT-EU	a year ago	Storm-0324 Exploits MS Teams Chats to Facilitate Ransomware Attacks
CERT-EU	a year ago	Microsoft Warns of New Phishing Campaign Targeting Corporations via Teams Messages \| #hacking \| #cybersecurity \| #infosec \| #comptia \| #pentest \| #ransomware \| National Cyber Security Consulting
CERT-EU	a year ago	August 2023's Most Wanted Malware : New ChromeLoader Campaign Spreads Malicious Browser Extensions while QBot is Shut Down by FBI – Global Security Mag Online
CERT-EU	a year ago	Three malware loaders behind 80% of intrusions, researchers find
CERT-EU	a year ago	Cybersecurity Companies Report Surge in Ransomware Attacks