Don’t accept the wire transfer. That’s the word from Microsoft’s Malware Protection Center, which recently uncovered a spam campaign spreading the notorious Trojan:Win32/Upatre downloader. Upatre has made the rounds before, trying to worm its way onto user systems through email and steal banking credentials. This time, however, the downloader comes with Dyreza, a notorious Trojan. With malware now going for broke, how do users stay in the black?

Banking on Acceptance

The emails from Upatre spammers aren’t particularly impressive, with most telling users they have been wired $35,292.00 and that claiming the money is as simple as opening the attached file, often named payment1872.zip. However, doing so redirects to either a continua.ltd.uk domain or an odecarequipa.com domain, where encrypted components containing PWS:Win32/Dyzap..H are downloaded, which is a variant on the original Dyreza. According to Microsoft, this threat was seen predominantly in the United States and Canada, with 77 percent and 14 percent of all Upatre detections, respectively. The rest of the world accounted for only 9 percent.

So what’s the big deal with Dyreza? As noted by Threatpost, this malware is extremely dangerous because it can bypass secure socket layer (SSL) encryption using a technique known as “browser hooking.” This intercepts all traffic flowing between a user’s machine and a legitimate website and works on any of the three major browsers: Chrome, Firefox and Internet Explorer. This allows it to steal banking credentials without triggering any warnings on either the host machine or the bank server. Once compromised, the malware contacts a command-and-control center every time a device is restarted.

A Long History

Both Upatre and Dyreza have been active this year. In September, Softpedia reported that a new form of Upatre had been detected, supposedly originating from a legitimate financial institution. Just last week, Upatre was spotted in a spam email claiming to be from a law firm investigating police actions in Ferguson, Missouri.

Dyreza, meanwhile, is described as one of today’s top five malware threats by eSecurity Planet, which notes that Bank of America, the Royal Bank of Scotland, Citibank, Ulster Bank and NatWest have all been targeted. At the end of November, the malware was busy exploiting vulnerability CVE-2014-4114 in Windows. With a track record of success for both pieces of software, it’s unlikely that either will see a slowdown in the near future, meaning users must be cognizant of potential risks.

The easiest way to stay safe? Don’t accept the wire transfer. There is no such thing as free money, especially when it comes in the amount of $35,000. No matter how well-worded the email or tempting the stash of funds, any message that asks users to download an attachment from a website redirect is bad news. As recent attempts indicate, the bait may not always be financial. Cybercriminals aren’t above using national or international issues as bait to convince users that a click is both necessary and safe.

The bottom line? If it seems too good to be true, it probably is. Avoid Upatre, avoid Dyreza, and don’t get hooked by spam.

More from

How Do You Plan to Celebrate National Computer Security Day?

In October 2022, the world marked the 19th Cybersecurity Awareness Month. October might be over, but employers can still talk about awareness of digital threats. We all have another chance before then: National Computer Security Day. The History of National Computer Security Day The origins of National Computer Security Day trace back to 1988 and the Washington, D.C. chapter of the Association for Computing Machinery’s Special Interest Group on Security, Audit and Control. As noted by National Today, those in…

Abuse of Privilege Enabled Long-Term DIB Organization Hack

From November 2021 through January 2022, the Cybersecurity and Infrastructure Security Agency (CISA) responded to an advanced cyberattack on a Defense Industrial Base (DIB) organization’s enterprise network. During that time frame, advanced persistent threat (APT) adversaries used an open-source toolkit called Impacket to breach the environment and further penetrate the organization’s network. Even worse, CISA reported that multiple APT groups may have hacked into the organization’s network. Data breaches such as these are almost always the result of compromised endpoints…

Deploying Security Automation to Your Endpoints

Globally, data is growing at an exponential rate. Due to factors like information explosion and the rising interconnectivity of endpoints, data growth will only become a more pressing issue. This enormous influx of data will invariably affect security teams. Faced with an enormous amount of data to sift through, analysts are feeling the crunch. Subsequently, alert fatigue is already a problem for analysts overwhelmed with security tasks. With the continued shortage of qualified staff, organizations are looking for automation to…

Worms of Wisdom: How WannaCry Shapes Cybersecurity Today

WannaCry wasn't a particularly complex or innovative ransomware attack. What made it unique, however, was its rapid spread. Using the EternalBlue exploit, malware could quickly move from device to device, leveraging a flaw in the Microsoft Windows Server Message Block (SMB) protocol. As a result, when the WannaCry "ransomworm" hit networks in 2017, it expanded to wreak havoc on high-profile systems worldwide. While the discovery of a "kill switch" in the code blunted the spread of the attack and newly…