Increased activity of Dridex

Dridex is a malware that will make its foothold using phishing emails.  The phishing emails have varied widely over the years [1].  The most common way for this malware to be downloaded to your computer is from Microsoft document from phishing emails containing hidden or obfuscated macros [1]. Once the compromised document is opened and macros are enabled the macro will reach out to a File Transfer Protocol (FTP) server to download the Dridex malware.  Microsoft prevents the execution of macros without user permission, but users will usually enable them due to social engineering or the curiosity to see the document.  Once downloaded, an active Dridex has the capability to do many malicious actions.  The main treat to financial activity is its ability to infiltrate and manipulate browser data [2]. Dridex can detect access to online banking applications and websites and inject additional malware to do keylogging to steal login information [3].  Dridex uses peer-to-peer networking to encrypt and transmit data that is captured [1].  Additionally, if deemed a high priority target Dridex can also download and activate a ransomware known as Locky causing additional damage to compromised computers [4].