Dridex Campaigns Hitting Millions of Recipients Using Unpatched Microsoft Zero-Day

11 April 2017
Comments Comments Off on Dridex Campaigns Hitting Millions of Recipients Using Unpatched Microsoft Zero-Day
11 April 2017, Comments Comments Off on Dridex Campaigns Hitting Millions of Recipients Using Unpatched Microsoft Zero-Day

This weekend saw multiple reports a new zero-day vulnerability that affected all versions of Microsoft Word. Today, Proofpoint researchers observed the document exploit being used in a large email campaign distributing the Dridex banking Trojan. This campaign was sent to millions of recipients across numerous organizations primarily in Australia.

This represents a significant level of agility and innovation for Dridex actors who have primarily relied on macro-laden documents attached to emails. While a focus on exploiting the human factor – that is, the tendency of people to click and inadvertently install malware on their devices in socially engineered attacks – remains a key trend in the current threat landscape, attackers are opportunists, making use of available tools to distribute malware efficiently and effectively. This is the first campaign we have observed that leverages the newly disclosed Microsoft zero-day.

Analysis

Emails in this campaign used an attached Microsoft Word RTF (Rich Text Format) document. Messages purported to be from “<[device]@[recipient’s domain]>”. [device] may be “copier”, “documents”, “noreply”, “no-reply”, or “scanner”. The subject line in all cases read “Scan Data” and included attachments named “Scan_123456.doc” or “Scan_123456.pdf”, where “123456” was replaced with random digits. Note that while this campaign does not rely on sophisticated social engineering, the spoofed email domains and common practice of emailing digitized versions of documents make the lures fairly convincing.

A sample email is shown in Figure 1 below.

Figure 1: Sample email from Dridex campaign exploiting Microsoft Word zero-day

When recipients open the document, the exploit — if successful — is used to carry out a series of actions that lead to the installation of Dridex botnet ID 7500 on the user’s system. During our testing (for example on Office 2010) the vulnerable system was fully exploited despite the fact that users were presented a dialog about the document containing “links that may refer to other files” (user interaction was not required). The dialog is shown in Figure 2:

Figure 2: Dialog box that appears when users open the document on vulnerable systems

[Source: Proofpoint]

What next?

To discuss your Systems and Network protection, please call us today on 01793 295000 to speak to an expert member of our team.

Comments are closed.

Bitnami