Dridex

Dridex is a family of banking trojans for Microsoft Windows that emerged in the early 2010s. It is designed to steal online banking credentials and financial information from infected computers, primarily through web injects and form grabbing during online banking sessions. The malware operates as a modular, botnet-based threat, with components downloaded from command-and-control servers after a successful infection.

Distribution and infection: Dridex is commonly spread via phishing emails containing malicious attachments or links. Word or Excel documents with macros are used to download the payload. Once installed, Dridex registers persistence in the system, connects to its botnet, and may download additional modules. The malware can monitor web pages, inject or modify HTML on banking sites, and capture credentials, one-time codes, and other sensitive data.

Variants and evolution: Dridex has undergone multiple revisions, adding new evasion techniques and webinject capabilities. It has relied on a widespread botnet infrastructure to coordinate infected hosts and distribute updates. Researchers have cited Dridex as one of the most prevalent banking trojans during the 2010s, with continued activity in later years despite takedowns of some infrastructure.

Mitigation and response: Defending against Dridex involves disabling macros by default, applying software patches, using endpoint security with heuristic and signature-based detection, and implementing strong phishing awareness. Network segmentation, monitoring for unusual C2 traffic, and promptly removing infected hosts are essential measures.