Drydex malware busting bursting British business bank balances

Re: Lower wool content for sec issues please

As Dridex =, Dyre and other variants of that family of malware morph, the signature/pattern-based a/v tools miss them completely, including email gateway and desktop vendors including F-secure, McAfee, and probably others. These are not zero-hour issues, they are closer to zero-minute issues that are exceedingly good at getting around pattern based and zero-hour layers of controls. The signature-based vendors will catch up, but by then many will have been delivered and some malicious attachments will have been opened and systems compromised. I won't pimp for the vendor we engaged with, but newer techniques in the email security space are providing another layer of protection to temp quarantine and examine these in controlled environments which are collecting global data in real time to determine if these are malicious or not. That seems to have helped a great deal, but some (far less than before) will still be delivered because of how rapidly these are changing.

Re: The gang behind the malware, dubbed Evil Corp.....

Do you think they call themselves Evil Corp? If so, just arrest everyone with an Evil Corp name badge within the square mile, job done.

"I assume this needs a web based e-mail program, or at least one that displays html documents for this to work."

Probably not. I don't know about you but I find that spam that claims to be an invoice actually has the alleged invoice in an attachment. Even if the enclosing email is plain text and read in a text-based browser anyone who actually thinks it's an invoice they have to look at it is going to try to open the attachment and that's the dangerous act.

"those in top management"

Those in top management might well be the source of a good deal of harm but this type of attack is likely to be aimed at accounts staff. They deal with invoices and banking.

These malware families do not require an HTML mail client to create a compromise, the payloads are in common attachments including MS Office Docs, PDF's etc, and once opened from any kind of client on at least windows boxes, they're off to the races.