The Patching Friars' AlmanacA calendar of CVE saints
DridexHoly card for d-dridex, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 $$$ Dridex PECUNIA HAMATA
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Circle VI · Banking trojans and infostealers

The Demon Dridex, Cashier of Evil Corp

Legend

A descendant of Cridex and Bugat, Dridex is a banking trojan active since 2014, spread mainly through macro-laden Office documents sent by the Necurs botnet, and stolen banking credentials let it take more than $100 million. It was run by Evil Corp, whose leader Maksim Yakubets was charged and sanctioned by the US in December 2019. A 2015 law-enforcement action barely dented it, and the group later moved into ransomware with BitPaymer and WastedLocker.

Exorcism

Cast it out by blocking Office macros and RTF/OLE exploits, and filtering malspam. Use transaction verification for payments and watch for credential theft, because the cashier must never be able to sign in your place.

Technical record

Also known as
Bugat, Cridex
Circle
Circle VI · Banking trojans and infostealers · Circle II · Legions (botnets) · Circle III · Ransomware and extortion
First seen
2014
Status
Dormant

A banking trojan derived from Cridex/Bugat, active since 2014 and spread mainly by Office macro malspam via Necurs. It was operated by Evil Corp, whose leader Maksim Yakubets was charged and sanctioned by the US in December 2019. A 2015 law-enforcement disruption had limited effect; the group later moved into ransomware.

Sources: attack.mitre.org · attack.mitre.org · justice.gov · MITRE ATT&CK reference S0384

© The MITRE Corporation. ATT&CK® information is reproduced and distributed with the permission of The MITRE Corporation.

📅 Add to your calendar

Saints:Google CalendarApple, Outlook and others (.ics)

Observances (feasts, scourges and miracles):Google CalendarApple, Outlook and others (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.