Loader / botnetATT&CK S0384
Dridex
Also known as: Bugat v5
Dridex is a banking trojan, spread mainly through spam with malicious Office documents, that stole online banking credentials to make fraudulent transfers. The US Treasury said in 2019 that Dridex had caused more than 100 million US dollars in theft. Its operators later moved into ransomware.
- Public attribution and associated actors
- The US Treasury sanctioned Evil Corp in 2019, describing it as the Russia-based group behind Dridex. MITRE ATT&CK also lists TA505 and Indrik Spider as users.As publicly reported:Evil CorpTA505
- First seen
- Around 2014
- Platforms
- Windows
- MITRE ATT&CK software entries
- S0384 Dridex
How it spreads or gets in
- Spam campaigns with malicious Office attachments that relied on the user enabling macros (CISA AA19-339A).
Key behaviours
- Hijacked browser sessions to steal and abuse banking credentials.
- Used DLL hijacking and signed system binaries to load.
- Routed command traffic through layers of proxies.
ATT&CK techniques
- T1566.001Phishing: Spearphishing Attachment
- T1204.002User Execution: Malicious File
- T1185Browser Session Hijacking
- T1218.010System Binary Proxy Execution: Regsvr32
- T1574.001Hijack Execution Flow: DLL
- T1090.003Proxy: Multi-hop Proxy
- T1053.005Scheduled Task/Job: Scheduled Task
Selected from the family's MITRE ATT&CK software entry, plus initial-access techniques named in the cited advisories.
Detection ideas
- Alert when Office applications launch regsvr32 or script interpreters.
- Detect legitimate executables loading DLLs from user-writable folders.
- Monitor for unusual banking-session behaviour and transaction patterns.
Defences that work
- Block macros from the internet and filter attachments.
- Require strong transaction authentication for online banking.
- Use application control on user-writable directories.