#RSAC
SESSION ID: HT-W10
The Dridex Swiss Army knife: big data dissolves the APT & crime grey area
Eward Driehuis Director of product Fox-IT @brakendelama #RSAC Understanding criminal evolution
Global visibility Collaboration
Investigations Feeds #RSAC
May 2014 #RSAC Rewind 9 years…
2006 Slavik launches ZeuS 2009 SpyEye & Carberp compete for market share 2010 Slavik creates ZeuS2 Hands over ZeuS support to the SpyEye guy 2011 ZeuS2 code leaks 2012 Gribodemon & Carberp members arrested
In 2009 Slavik had joined JabberZeuS And Evolved to GameOver / P2PZeuS #RSAC The Businessclub Legacy
Businesslike Financial guy perfected money laundry Targeted commercial banking Perfected the Hybrid attack / Tokengrabber Perfected ransomware / Cryptolocker Did some “light espionage” #RSAC Business club after Slavik
Dyre Businessclub (GameOver ZeuS gang until May 2014) EvilCorp (Dridex crew) #RSAC Dridex: EvilCorp’s Swiss Army knife #RSAC EvilCorp network expands
Core businessclub members in EvilCorp & Dridex operators Leveraging existing money laundry networks Branching out: Dridex operators do ransomware, RATs, Credit Cards, high value targets Ties with Anunak / Carbanak #RSAC Dridex Malware
Based on Bugat/Cridex/Feodo, since 2014 Speading: scattergun (spam / attachments) Modular architecture P2P, with 3 operating modes: Token Grabber, data mining, inter node comm Using businessclub technology Loader dropping many different malwares #RSAC #RSAC EvilCorp: Dridex Targets 2015 -2017 #RSAC EvilCorp: ”Gucci” accounts
Harvesting data from victims Big data techniques to find high value accounts Selected targets moved into other silo’s Or to specialist operator groups #RSAC Dridex botnets & back-ends
(Snapshot May 2016) #RSAC EvilCorp organization #RSAC RAT attacks
All targets are pre-selected Machines deep inside organizations Installer drops RAT and logs details Targeting PKI smartcard based banking The attackers patiently wait to execute a few or a single high value fraud #RSAC Targeted attacks, resembling APT bahavior
Intrusion behavior Metasploit, etc… Gathering intel first Lateral movement Sleeper cell, biding their time #RSAC Not the only gang in town
TheTrick Dridex Operator Groups Multiple Operators using ZeuS variants #RSAC Criminals think like businesses
2006 2011 2016
+Commercial + SME Retail Banks + Individuals Banks + Enterprise
Invest Return Invest Return Invest Return #RSAC Moving away from end-point 2006 2011 2016
Webinjects: Hybrid: RAT: Automate Webinject / fakes No browser manipulation complete steal creds & auth Operator looks workflow Operator does over shoulder the rest #RSAC Evolving their money laundry networks 2006 2011 2016
$ 1,000,000 $ 1,000,000 $ 81,000,000 #RSAC The game has changed
2006 2011 2016
Victims
Tech Level
Money Laundry Capability #RSAC Risk for criminals decreasing Targeting enterprise with the same MO Lateral movement / APT techniques Sleeper cells
[email protected] @brakendelama