Dyre

Dyre, also known as Dyreza or Dyzap, is a banking Trojan that was initially designed to monitor online banking transactions with the aim of stealing passwords, money, or both. It first emerged in 2009 and 2010, targeting victim bank accounts held at various U.S.-based financial institutions. These initial attacks were linked to Kovalev, who was later indicted for conspiracy to commit bank fraud and eight counts of bank fraud. The Dyre malware subsequently evolved into a more sophisticated form of malicious software, impacting non-Russian businesses. In 2016, security researchers identified TrickBot, an evolution of the Dyre malware. TrickBot started as a banking trojan but soon expanded its capabilities, providing its operators with a full suite of tools to conduct illegal cyber activities. Over time, it became a vector for Conti and Ryuk ransomware, causing widespread disruption. The same year, authorities connected a raid on Moscow offices to a crackdown on the Dyre malware, leading to significant disruption of a top cybercrime ring. By 2020, the threat posed by TrickBot had grown significantly, prompting U.S. Cyber Command to mount an operation to disrupt the botnet ahead of the American presidential election to prevent potential ransomware attacks on state or local voter registration offices. Despite these efforts, traces of the old Dyre code could still be seen in the TrickBot bot, indicating a correlation between the two. The TrickBot malware has since continued to evolve, using similar but slightly modified versions of the old Dyre command and control decryption routines.