Dridex virus: millions stolen from UK bank accounts in cyber attack
Around £20 million stolen from British bank accounts alone due to Dridex virus.
The National Crime Agency is warning UK internet users to protect themselves against a piece of malware dubbed ‘Dridex’ which has so far been used to steal an estimated £20 million in the UK alone.
Security expert Brian Krebs, on his blog Krebs on Security, estimates that over $100 million has been stolen worldwide from banks and businesses by a cybercrime gang using the software, which is also known as Cridex and Bugat.
Phishing scam
The virus is distributed via email attachments. The email will typically seek to get the recipient to open this attachment by suggesting that an invoice or details of a payment are contained within the attachment.
When opened, the malicious software installs itself on the target computer. It can then snoop on internet traffic and steal information such as usernames and passwords with the aim of using these to compromise bank accounts.
Cyber-crime arrests
The FBI last night revealed that a 30-year-old Moldovan man, Andrey Ghinkul, was arrested on 28th August in Cyprus, on suspicion of criminal conspiracy, unauthorised computer access with intent to defraud and bank fraud, among other charges in a nine-count indictment.
He allegedly ran a network of ‘zombie’ computers infected with malware that forced them to forward the virus to more people, unbeknownst to the owners of the infected computers. This arrangement is known as a ‘botnet’, short for ‘robot network’.
Mike Hulett, Head of Operations at the UK’s National Cyber Crime Unit described Dridex as a “particularly virulent form of malware”. Hulett said that further arrests are expected to be made.
The United States is seeking Ghinkul’s extradition – it estimates the loss of $10 million to Dridex-related crime within its borders.
Is it still going on?
The FBI says that action taken by the UK and USA has “substantially disrupted” the criminal operation. The arrest of Ghinkul was followed up by action taken by the Dell SecureWorks Counter Threat Unit, which was given permission to attack Ghinkul’s botnet and take it over to prevent the further dissemination of the software.
The group behind the attacks called themselves ‘Evil Corp’, possibly in reference to the hacktivist drama Mr Robot in which a large company of the same name appears. They largely attacked businesses, so it is perhaps unlikely – though not impossible – that you have been affected by it.
But the Dridex software still exists and it, or similar software, could in future be used by other criminals. It is certainly not the the only piece of malicious code that could exploit your bank account details.
If you receive emails that look at all suspicious, do not open attachments or click on links, and do not reply.
What to do if you think you’ve been affected
If you believe that you may have lost money through malware infection, contact Action Fraud using its online form or call 0300 123 2040.
You can also report scam emails to Action Fraud.
Protect yourself from scams
How to protect your PINs and passwords
Comments
Be the first to comment
Do you want to comment on this article? You need to be signed in for this feature