DoppelDridex Used by Financially-motivated Actors
DoppelDridex is a peculiar malware sample, which is being actively spread through several phishing campaigns. The criminals are using a modified version of the Dridex Malware to deploy additional payloads – such as the Cobalt Strike beacon, and the Grief Ransomware. As the name suggests, the DoppelPaymer gang is affiliated with this project. They are also behind the Grief Ransomware, a rebranded version of the infamous DoppelPaymer Ransomware.
The criminals are abusing legitimate services to host the malicious files they deliver to victims. In all of the current campaigns, they host malicious Excel files on the Discordapp.com and Files.slack.com services. These legitimate domains are used by the Slack and Discord applications to share files between users. However, they only use them to host files – the perpetrators still approach victims from phishing email messages.
DoppelDridex May End Its Attacks with the Grief Ransomware
The use of the DoppelDridex Malware is attributed to a gang tracked under the alias DoppelSpider. They have been heavily focusing on the use of Discord and Slack to propagate their malware as of late. Using legitimate services to host payloads is not uncommon for cybercriminals because of several reasons:
- Users tend to trust familiar domains more.
- Most firewall and security configurations do not block content from Discord and Slack.
Needless to say, the DoppelSpider gang is financially-motivated. They are using the initial payload to gather sensitive data from the victim, but they also often deploy secondary implants for more control. Currently, it appears as if the Grief Ransomware is the final payload they use to profit off of their attacks.
Remember not to automatically trust files hosted on familiar domains – always run them through a security scanner first. Since the criminals are still relying on email phishing, you should be careful when interacting with new and unknown emails, especially if the sender appears random. Do not follow their links or view their attachments.
