FBI takes down Dridex botnet, seizes servers, arrests suspect

C&C malware factory


The FBI has teamed up with security vendors to disrupt the operations of Dridex banking Trojan.

Multiple command-and-control (C&C) servers used by the Dridex Trojan have been taken down and seized in a co-ordinated action after the FBI obtained court orders. The take-down operation is geared towards crippling the malware’s control network, which is used to upload stolen information to crooks behind the network as well as pushing instructions and software configuration to zombie nodes on the botnet. Attack traffic is being re-routed towards sinkholes under the control of an organisation called The Shadowserver Foundation.

In addition, Moldovan Andrey Ghinkul has been charged by the US with multiple offences related to allegedly acting as the kingpin behind Bugat/Dridex. Ghinkul (whom the Feds allege is AKA Smilex), 30, was arrested in late August in Cyprus but not named at the time. The US is seeking his extradition on charges of criminal conspiracy, unauthorised computer access with intent to defraud, damaging a computer, wire fraud and bank fraud, as a DoJ statement explains.

Dridex has stepped out of the shadow of ZeuS and become one of the most prevalent banking Trojans over recent months. It has breached tens of thousands of organisations across 27 countries around the globe and has been responsible for over £20m (roughly $30.5m) in losses in the UK, and at least $10m in losses in the United States.

The cybercrime toolkit, which bundles a variety of key-logging and web-inject functionality has infected tens of thousands of computers worldwide and targets the theft of financial credentials, certificates, cookies to facilitate online banking and wire fraud. Dridex - which first surfaced in July 2014 and is generally considered a descendant of an earlier banking trojan called Cridex - hit the UK, US and France especially hard.

Dridex is distributed through spam emails in various guises. Initially the spam email attachments exploited vulnerabilities. More recently however, the attackers have used Microsoft Word macros to infect systems. After the target opens the Word document, the macro attempts to download and execute the Dridex loader, which in turn installs the other botnet components.

The Dridex botnet operates an affiliate model and the botnet itself is partitioned into 13 sub-botnets, and each affiliate is given access to its own subset of bots. The takedown was accomplished by poisoning each sub-botnet’s P2P network and redirecting infected systems to a sinkhole, This meant infected computers of the Dridex botnet are no longer under the cybercrooks. Compromised machines are still infected so a clean up operation needs to take place. US CERT has advice on that front here.

Dridex features many of the same techniques and tactics as earlier botnets such as Gameover Zeus and its recent success can be at least partly explained by its exploitation of a gap in the market left by the earlier Gameover Zeus botnet takedown.

“The takedown of the Gameover Zeus botnet in June 2014 as part of Operation Tovar left a void in the cybercriminal community, particularly for those targeting financial institutions,” Brett Stone-Gross of Dell SecureWorks’ Counter Threat Unit explained. “To fill this gap, threat actors created new botnets, including Dridex and Dyre. CTU researchers have observed a significant overlap in the tactics, techniques, and procedures (TTPs) between Gameover Zeus and both Dridex and Dyre, indicating that previous affiliates had moved on to new botnet business ventures and were continuing to carry out their fraudulent activities. However, neither Dridex nor Dyre has been able to rival the sophistication, size and success of Gameover Zeus.” ®

Similar topics

Broader topics


Other stories you might like

  • International operation takes down Russian RSOCKS botnet
    $200 a day buys you 90,000 victims

    A Russian operated botnet known as RSOCKS has been shut down by the US Department of Justice acting with law enforcement partners in Germany, the Netherlands and the UK. It is believed to have compromised millions of computers and other devices around the globe.

    The RSOCKS botnet functioned as an IP proxy service, but instead of offering legitimate IP addresses leased from internet service providers, it was providing criminals with access to the IP addresses of devices that had been compromised by malware, according to a statement from the US Attorney’s Office in the Southern District of California.

    It seems that RSOCKS initially targeted a variety of Internet of Things (IoT) devices, such as industrial control systems, routers, audio/video streaming devices and various internet connected appliances, before expanding into other endpoints such as Android devices and computer systems.

    Continue reading
  • EnemyBot malware adds enterprise flaws to exploit arsenal
    Fast-evolving botnet targets critical VMware, F5 BIG-IP bugs, we're told

    The botnet malware EnemyBot has added exploits to its arsenal, allowing it to infect and spread from enterprise-grade gear.

    What's worse, EnemyBot's core source code, minus its exploits, can be found on GitHub, so any miscreant can use the malware to start crafting their own outbreaks of this software nasty.

    The group behind EnemyBot is Keksec, a collection of experienced developers, also known as Nero and Freakout, that have been around since 2016 and have launched a number of Linux- and Windows-based bots capable of launching distributed denial-of-service (DDoS) attacks and possibly mining cryptocurrency. Securonix first wrote about EnemyBot in March.

    Continue reading
  • Microsoft sounds the alarm on – wait for it – a Linux botnet
    Redmond claims the numbers are scary, but won't release them

    Microsoft has sounded the alarm on DDoS malware called XorDdos that targets Linux endpoints and servers.

    The trojan, first discovered in 2014 by security research group MalwareMustDie, was named after its use of XOR-based encryption and the fact that is amasses botnets to carry out distributed denial-of-service attacks. Over the last six months, Microsoft threat researchers say they've witnessed a 254 percent spike in the malware's activity. 

    "XorDdos depicts the trend of malware increasingly targeting Linux-based operating systems, which are commonly deployed on cloud infrastructures and Internet of Things (IoT) devices," Redmond warned

    Continue reading
  • Microsoft-led move takes down ZLoader botnet domains
    That should keep the criminals offline for, well, weeks probably

    Microsoft has announced a months-long effort to take control of 65 domains that the ZLoader criminal botnet gang has been using to spread the remote-control malware and orchestrate infected machines.

    The tech giant's Digital Crimes Unit obtained a court order from a US federal judge in Georgia to take down the domains, which are now directed to a Microsoft-controlled sinkhole so they can't be used by the malware's masterminds to communicate with their botnet of commandeered Windows computers.

    From what we can tell from the filings submitted by Microsoft to the courts, its justification for the seizure is that ZLoader used the domains to injure the Windows giant as well as residents of the US state and commit computer fraud, infringement of Microsoft trademarks, and other illegal activity. The trademark infringement being that at least one of the domains was used for a website that featured Microsoft trademarks in an attempt to masquerade as a legit Redmond site, and also references in phishing emails to Microsoft-trademarked programs, such as Excel.

    Continue reading
  • Attackers exploit Spring4Shell flaw to let loose the Mirai botnet
    Trend Micro says vulnerable systems in Singapore have been compromised

    There has been a land rush of sorts among threat groups trying to use the vulnerability discovered in the open-source Spring Framework last month, and now researchers at Trend Micro are saying it's being actively exploited to run the Mirai botnet.

    Mirai is a long-running threat that has been around since 2016 and is used to pull smaller networked and Internet of Things (IoT) devices, such as IP cameras and routers, into a botnet that can then be used in such campaigns as distributed denial-of-service (DDoS) and phishing attacks.

    The Trend Micro researchers wrote in a post that they observed the bad actors weaponizing and run Mirai malware on vulnerable servers in the Singapore region via the Spring4Shell vulnerability, tracked as CVE-2022-22965.

    Continue reading
  • Feds take down Kremlin-backed Cyclops Blink botnet
    Control systems scrubbed, hijacked network devices need to be patched and cleaned

    The US Justice Department today revealed details of a court-authorized take-down of command-and-control systems the Sandworm cyber-crime ring used to direct network devices infected by its Cyclops Blink malware.

    The move follows a joint security alert in February from US and UK law enforcement that warned of WatchGuard firewalls and ASUS routers being compromised to run Cyclops Blink. This botnet malware – technical breakdown here [PDF] – allows the equipment to be remote controlled to carry out attacks on behalf of its masterminds.

    Previously, Uncle Sam said the Sandworm crew worked for the Russian Federation's GRU espionage nerve-center, which handles foreign intel operations. 

    Continue reading
  • Techniques to fool AI with hidden triggers are outpacing defenses – study
    Here's how to catch up with those poisoning machine-learning systems

    The increasingly wide use of deep neural networks (DNNs) for such computer vision tasks as facial recognition, medical imaging, object detection, and autonomous driving is going to, if not already, catch the attention of cybercriminals.

    DNNs have become foundational to deep learning and to the larger field of artificial intelligence (AI). They're a multi-layered class of machine learning algorithms that essentially try to mimic how a human brain works and are becoming more popular in developing modern applications.

    That use is expected to increase rapidly in the coming years. According to analysts with Emergen Research, the worldwide market for DNN technology will grow from $1.26bn in 2019 to $5.98bn by 2027, with demand in such industries as healthcare, banking, financial services and insurance surging.

    Continue reading

Biting the hand that feeds IT © 1998–2022