Dridex Lures Employee with Job Termination Emails

What has happened?

• The malware operators were sending employee termination emails that tell recipients that their employment is ending on 24 December this year, and this decision cannot be changed.
• The emails included an attached password-protected spreadsheet which has the source for Dridex malware.
• Once launched, it installs other malware, steals credentials, and performs other malicious actions.

The infection chain

• If the victim chose to Enable Content, a popup is displayed to troll the victim with an alert - Merry X-Mas Dear Employees!. However, malicious macros get executed in the background and launch a malicious HTA file.
• This HTA file has a random name and pretends to be an RTF file, although it has a VBScript to download Dridex from Discord to compromise the device, along with a troll message.

Recent incidents

• In the past few weeks, a Dridex affiliate was found operating multiple email campaigns where they trolled the researchers using email addresses and filenames laden with anti-semitic and racist words. 
• Moreover, a few days ago, some actors were observed using the Log4j vulnerability to install Dridex.

Conclusion