February 8, 2016 By Douglas Bonderud 2 min read

Banking malware Dridex has been active for several years, dropping onto victim computers via malicious Word attachments and grabbing financial information. But now there’s a twist: According to CSO Online, some malware’s command-and-control (C&C) servers have been repurposed to send out different code — an up-to-date, free antivirus program. Is this the first step toward beating back banking malware?

Dridex Maintains Its ROI

Authorities haven’t been ignoring this malware: A high-profile takedown operation in 2015 disrupted many servers and indicted a Moldavian man for a portion of these Trojan attacks. The problem? In just a few months, the malware was back at full strength.

As noted by a January 2016 piece from PCWorld, Dridex even added a few new features, such as DNS cache poisoning. Once infected, victim computers would be directed to fake banking sites even if the legitimate domain name is typed into the browser.

The malware-makers recreated 13 of the U.K.’s most popular bank websites to convince users they’d landed on the real page, putting them at ease to enter login information or even SMS codes sent by their actual bank.

Even worse? Banks had no idea the fraud was occurring since their websites were never involved. For Dridex distributors, it seems, the government takedown had little effect on their ROI and spurred the adoption of new, more aggressive features.

A New Approach

With Dridex back in full force — and, as noted by Graham Cluley, also leveraging JavaScript attacks in email attachments purportedly coming from toilet hiring services — it makes sense that white-hat hackers would feel a measure of frustration. After all, the concerted government effort barely dented the malware campaign.

As noted by The Register, however, something strange happened: Some victims are getting a full install of Aviva Antivirus instead of Dridex. While it does require users to accept and manage the installation, it’s a strange step in the right direction — one that no agency or government is claiming as its own.

Moritz Kroll of Aviva said it’s not his company distributing the product, and although there’s some speculation that Dridex creators might be behind the change in an effort to make their package more difficult to detect, the prevailing theory is that white-hat hackers have taken it upon themselves to solve an obvious issue.

It’s not a complete solution, and there’s no way to predict if users will get the infected or the antivirus file, but it’s interesting to see a turning of tables. Proof positive, in other words, that a great defense starts with a good offense.

More from

Taking the complexity out of identity solutions for hybrid environments

4 min read - For the past two decades, businesses have been making significant investments to consolidate their identity and access management (IAM) platforms and directories to manage user identities in one place. However, the hybrid nature of the cloud has led many to realize that this ultimate goal is a fantasy. Instead, businesses must learn how to consistently and effectively manage user identities across multiple IAM platforms and directories. As cloud migration and digital transformation accelerate at a dizzying pace, enterprises are left…

IBM identifies zero-day vulnerability in Zyxel NAS devices

12 min read - While investigating CVE-2023-27992, a vulnerability affecting Zyxel network-attached storage (NAS) devices, the IBM X-Force uncovered two new flaws, which when used together, allow for pre-authenticated remote code execution. Zyxel NAS devices are typically used by consumers as cloud storage devices for homes or small to medium-sized businesses. When used together, the flaws X-Force discovered allow a remote attacker to execute arbitrary code on the device with superuser permissions and without requiring any credentials. This results in complete control over the…

What cybersecurity pros can learn from first responders

4 min read - Though they may initially seem very different, there are some compelling similarities between cybersecurity professionals and traditional first responders like police and EMTs. After all, in a world where a cyberattack on critical infrastructure could cause untold damage and harm, cyber responders must be ready for anything. But are they actually prepared? Compared to the readiness of traditional first responders, how do cybersecurity professionals in incident response stand up? Let’s dig deeper into whether the same sense of urgency exists…

Unified endpoint management for purpose-based devices

4 min read - As purpose-built devices become increasingly common, the challenges associated with their unique management and security needs are becoming clear. What are purpose-built devices? Most fall under the category of rugged IoT devices typically used outside of an office environment and which often run on a different operating system than typical office devices. Examples include ruggedized tablets and smartphones, handheld scanners and kiosks. Many different industries are utilizing purpose-built devices, including travel and transportation, retail, warehouse and distribution, manufacturing (including automotive)…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today