Netskope Threat Labs

Dridex

ATP Sandbox Adv. HeuristicsAVNetskope IPS

Description

Dridex has been around since at least 2015 and has had its botnet infrastructure taken down multiple times, but it continues to re-emerge with new features and new infrastructure. The banking trojan steals credentials through web injects and form grabbing, and its operators rent out the botnet as a loader for ransomware and other payloads. Its resilience comes from a modular design and a criminal organization, Evil Corp, that repeatedly rebuilds its delivery chains after disruption.

Stats

First seen
January 2022
Last seen
October 2026

MITRE ATT&CK techniques

15 techniques across 5 tactics.

TA0002 Execution

TA0005 Stealth

TA0007 Discovery

  • T1082System Information Discovery
  • T1518Software Discovery

TA0009 Collection

  • T1185Browser Session Hijacking

TA0011 Command and Control

Associated groups

Alert name variants

Alert Name
Binary.Infostealer.Dridex
Binary.Trojan.Dridex
DeepScan:Generic.Dridex.Y.D1888308
Document-Excel.Infostealer.Dridex
Document-Excel.Trojan.Dridex
Document-Office.Infostealer.Dridex
Document-Word.Infostealer.Dridex
Document-Word.Trojan.Dridex
Email-MIME.Infostealer.Dridex
Gen:Variant.Application.Jaik.Dridex.39019

Related IPS Signatures

Signature Name
MALWARE-OTHER Win.Trojan.Dridex malicious executable download attempt

Related blogs

Related families

QakBotTrickBotInvisiMoleRTMBazar

References