Skip to main content

Dridex Botnet Spreading Locky Ransomware Via JavaScript Attachments

posted onMarch 11, 2016
by l33tdawg

The Dridex botnet operators have recently changed the delivery mechanism in their spam campaigns, as well as the payload, to deliver the Locky ransomware, researchers at Trustwave warn.

The security firm has observed a massive spam campaign of over 4 million malware spams, with malware accounting for 18 percent of the total spam detected. A recent blog post from TrustWave's Rodel Mendrez also reveals that the campaign was not continuous, but done it concentrated bursts, with peaks of 200K emails hitting servers in a single hour.

Although the spam came from the same botnet used to spread Dridex via documents with malicious macros, the threat actors behind the campaign have changed the distribution mechanism to use JavaScript (.js) attachments.  Additionally, the cybercriminals have changed the end malware being used, which is now the Locky ransomware. Dridex and Locky were said before to be connected, with a notable similarity in tactics when both switched to using Form object in macros to obfuscate their malicious code.

Source

Tags

Security

You May Also Like

Recent News

Friday, November 29th

Tuesday, November 19th

Friday, November 8th

Friday, November 1st

Tuesday, July 9th

Wednesday, July 3rd

Friday, June 28th

Thursday, June 27th

Thursday, June 13th

Wednesday, June 12th

Tuesday, June 11th

Simplenews subscription

Stay informed - subscribe to our newsletter.
The subscriber's email address.
Keeping Knowledge Free for Over a Decade

Copyright © 2018 Hack In The Box. All rights reserved.

36th Floor, Menara Maxis, Kuala Lumpur City Centre 50088 Kuala Lumpur Malaysia
Tel: +603-2615-7299 Fax: +603-2615-0088