Europol supports FBI and NCA in hunt for Dridex malware

Europol, the British National Crime Agency and the FBI are working together to neutralize the Dridex malware. According to an estimate by the authorities, 20 million pounds, or about 27 million euros, has already been stolen in the United Kingdom through this malware.

Europol has announced that its European Cybercrime Center division will provide support to the UK and US services. Dridex, malware that targets bank details and is spread through phishing emails, is said to have been designed by a group of criminals from Eastern Europe and appears to be mainly active in the United Kingdom. Infected computers become part of a botnet.

The malware was first discovered in November 2014, writes security expert Mithun Sanghavi. The attackers infect computers after opening a Word or Excel document, which contains a payload that downloads the malware. Infection can only occur if users have activated macros in the Microsoft software. Once infected, the criminals gain almost complete control over the system.

The European Cybercrime Center is working with the Joint Cybercrime Action Taskforce (J-CAT) and the NCA to set up a dns sinkhole. As a result, infected computers can no longer communicate with their command and control server. This renders the malware harmless and may provide authorities with insight into the structure and origin of the botnet. The FBI is also working on its own sinkhole operation in the US.

According to Europol, the partnership with NCA and FBI is part of a larger campaign against multiple versions of Dridex and the criminals behind the malware. They would operate in ‘parts of the world that are difficult to reach’.

Forbes writes that Dridex is now in the spotlight of the services because of a significant increase in activity in recent months. In August, Andrey Ghinkul, also known as Smilex, was arrested in Cyprus. He is suspected of being the administrator of the Dridex botnet; the US is asking for his extradition.

The group behind Dridex would call itself Evil Corp and would have close ties to the criminals behind the Cryptolocker botnet. That botnet has been dismantled, but Evgeniy Bogachev, who is believed to be the mastermind behind the operation, is still at large. The FBI still has a reward of up to $3 million for information that could lead to his arrest or conviction.