CYBER NEWS

New Geodo Malware – Dridex – Known to Infect Microsoft Office Macros

New Geodo MalwareDuring the last week, Palo Alto Networks security researchers have noticed that Dridex, the latest version of the Cridex Trojan, a data stealer also known as Feodo, Bugat and Geodo has been activated to attack bank security information through embedding automated scripts with repeating tasks into the macros of the Microsoft Office Package.

According to the researchers the Dridex campaign has started on 21st October, 2014 beginning to send out messages claiming to contain electronic financial documents (e-invoices, etc.) from different merchants, including Humber Merchant’s Group – a company dealing in the construction field.

The Didex malware is the latest version of the Feodo / Bugat / Cridex Trojan horse, developed in Geodo. It keeps its previous versions abilities for stealing information but these are changed to users receiving attachment files containing macros on their e-mail accounts. One of the changes in the Dridex virus, noticed last week, is sending out Microsoft Word documents with macros forcing users to download malicious software on their machines.

After users receive and open the infected Word document, the macros behind start executing the tasks embedded in their scripts, having one and the same aim – stealing online bank certificates and security information, so hackers can access and empty users’ bank accounts.

It seems that the main aim of the attack are users in the United States, as almost half of the e-mails in the researcher’s extract are based there. There were e-mail accounts registered in other countries as well though – Australia, Canada, United Kingdom, The Netherlands, Belgium, Germany, Norway, Spain., Israel and Taiwan.

Although there was no official statement on the Dridex malware from Microsoft by the time the article was written, they have taken precautions to limit the issue by turning off macros from their Office Package components. They can be activated by users any time though, so basically a good protection against the malware is to turn off macros from your Microsoft Word or any other office documents you might have such running on.

The Feodo tracker, a service offered by the abuse.ch web-site for keeping an eye on the malware command and control servers shows that there are 93 servers for Dridex communication, 12 of which currently online. Four of them are known to be located in Russia.

Avatar

Berta Bilbao

Berta is a dedicated malware researcher, dreaming for a more secure cyber space. Her fascination with IT security began a few years ago when a malware locked her out of her own computer.

More Posts

1 Comment

  1. AvatarYoeri

    Very useful article, do you have any information about which AV can detect this new strain?
    I tried googling for the information but nothing seems to come up..

    Reply

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Loading...
Share on Twitter Tweet
Loading...
Share on Google Plus Share
Loading...
Share on Linkedin Share
Loading...
Share on Digg Share
Share on Reddit Share
Loading...
Share on Stumbleupon Share
Loading...