Cyber Threat Trends

First reported date: 2015/01/09
Inquiry period : 2025/03/31 20:57 ~ 2025/04/30 20:57 (1 months), 1 search results

전 기간대비 -200% 낮은 트렌드를 보이고 있습니다.
악성코드 유형 Black Basta FriedEx Hades BlackCat 도 새롭게 확인됩니다.
기관 및 기업 Google Trend Micro CrowdStrike 도 새롭게 확인됩니다.
기타 Advertising Browser Java malpedia Mand 신규 키워드도 확인됩니다.

OxCERT blog describes Dridex as "an evasive, information-stealing malware variant; its goal is to acquire as many credentials as possible and return them via an encrypted tunnel to a Command-and-Control (C&C) server. These C&C servers are numerous and scattered all over the Internet, if the malware cannot reach one server it will try another. For this reason, network-based measures such as blocking the C&C IPs is effective only in the short-term."
According to MalwareBytes, "Dridex uses an older tactic of infection by attaching a Word document that utilizes macros to install malware. However, once new versions of Microsoft Office came out and users generally updated, such a threat subsided because it was no longer simple to infect a user with this method."
IBM X-Force discovered "a new version of the Dridex banking Trojan that takes advantage of a code injection technique called AtomBombing to infect systems. AtomBombing is a technique for injecting malicious code into the 'atom tables' that almost all versions of Windows uses to store certain application data. It is a variation of typical code injection attacks that take advantage of input validation errors to insert and to execute malicious code in a legitimate process or application. Dridex v4 is the first malware that uses the AtomBombing process to try and infect systems."  Ref.

 * 최근 뉴스기사 Top3:
    ㆍ 2025/04/03 Tracking Adversaries: EvilCorp, the RansomHub affiliate


참고로 동일한 그룹의 악성코드 타입은 FormBook QakBot RedLine 등 101개 종이 확인됩니다.