Dridex Malware Now Attacking macOS Systems with Novel Infection Method

Jan 06, 2023Ravie LakshmananUnited States

A variant of the infamous Dridex banking malware has set its
sights on Apple’s macOS operating system using a previously
undocumented infection method, according to latest research.

It has “adopted a new technique to deliver documents embedded
with malicious macros to users without having to pretend to be
invoices or other business-related files,” Trend Micro researcher
Armando Nathaniel Pedragoza said^[1]
in a technical report.

Dridex^[2], also called Bugat and
Cridex, is an information stealer that’s known to harvest sensitive
data from infected machines and deliver and execute malicious
modules. It’s attributed to an e-crime group known as Evil Corp
(aka Indrik Spider).

The malware is also considered to be a successor of Gameover Zeus^[3], itself a follow-up to
another banking trojan called Zeus. Previous Dridex campaigns
targeting Windows have leveraged^[4]
macro-enabled Microsoft Excel documents sent via phishing emails to
deploy the payload.

Trend Micro’s analysis of the Dridex samples involves a Mach-O^[5] executable file, the
earliest of which was submitted to VirusTotal in April 2019. Since
then, 67 more artifacts have been detected in the wild, some as
recent as December 2022.

The artifact, for its part, contains a malicious embedded
document – first detected^[6]
way back in 2015 – that incorporates an Auto-Open macro^[7]
that’s automatically run upon opening the document.

This is achieved by overwriting all “.doc” files in the current
user directory (~/User/{user name}) with the malicious code
extracted from the Mach-O executable in the form of a hexadecimal
dump.

“While the macro feature in Microsoft Word is disabled by
default, the malware will overwrite all the document files for the
current user, including the clean files,” Pedragoza explained.
“This makes it more difficult for the user to determine whether the
file is malicious since it doesn’t come from an external
source.”

The macros included in the overwritten document are engineered
to contact a remote server to retrieve additional files, which
includes a Windows executable file that will not run in macOS,
indicating that the attack chain is a work in progress. The binary,
in turn, attempts to download the Dridex loader onto the
compromised machine.

While documents containing booby-trapped macros are typically
delivered via social engineering attacks, the findings once again
show that Microsoft’s decision to block
macros^[8] by default has prompted
threat actors to refine their tactics and find more efficient
methods of entry.

“Currently, the impact on macOS users for this Dridex variant is
minimized since the payload is an exe file (and therefore not
compatible with MacOS environments),” Trend Micro said. “However,
it still overwrites document files which are now the carriers of
Dridex’s malicious macros.”