The Dyre banking Trojan (aka Dyreza, Dyranges) has been a steady and reliable threat in the cybercrime landscape since it was first reported in 2014, and during most of 2014 the threat actors driving it appeared to be content to use it with few or no changes in delivery techniques. In late 2014 and continuing through January 2015, however, the actors distributing the Dyre banking Trojan undertook a sudden and rapid evolution of their malware and infrastructure. They modified their TTPs in an attempt to improve malware delivery and installation rates. Specifically we noticed constant changes in spam templates, URL randomization, JavaScript obfuscation, and attempts at analysis and sandbox evasion.
- TEAM OF PROOFPOINT RESEARCHERS
- InfoSecurity
- Posted On
