Dridex
Software · ATTACK:enterprise:S0384
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0384",
"title": "Dridex",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0384",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--f01e2711-4b48-4192-a2e8-5f56c945ca19",
"external_id": "S0384",
"domain": "enterprise",
"created": "2019-05-30T19:47:37.192Z",
"modified": "2025-04-16T20:38:42.420Z",
"version": "2.1",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Bugat v5"
},
{
"source_name": "Dridex"
},
{
"source_name": "Checkpoint Dridex Jan 2021",
"url": "https://research.checkpoint.com/2021/stopping-serial-killer-catching-the-next-strike/"
},
{
"source_name": "Dell Dridex Oct 2015",
"url": "https://www.secureworks.com/research/dridex-bugat-v5-botnet-takeover-operation"
},
{
"source_name": "Kaspersky Dridex May 2017",
"url": "https://securelist.com/dridex-a-history-of-evolution/78531/"
},
{
"source_name": "Treasury EvilCorp Dec 2019",
"url": "https://home.treasury.gov/news/press-releases/sm845"
}
]
}Explicit source assertions (17)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0384 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0245022b-05ac-4d66-ae9f-e4c2f604c07a
Kaspersky Dridex May 2017ATTACK:enterprise:S0384 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--112b896f-a3df-4b7c-80cd-332d561bc028
Red Canary Dridex Threat Report 2021ATTACK:enterprise:S0384 → uses → ATTACK:enterprise:T1219
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--11d5cf7f-7b0c-49b3-b8d0-9906f440d2d0
Dell Dridex Oct 2015ATTACK:enterprise:S0384 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--19e06de9-b9a1-4532-94c6-f729036ba0c3
Checkpoint Dridex Jan 2021ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:S0384
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1e7f0283-1aeb-4b9e-81e0-4aec48e30228
IBM TA505 April 2020 · Proofpoint TA505 Sep 2017 · Proofpoint TA505 June 2018ATTACK:enterprise:S0384 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3da68907-c8f3-4a45-b831-bdadb1161921
Red Canary Dridex Threat Report 2021ATTACK:enterprise:S0384 → uses → ATTACK:enterprise:T1185
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3f3fffec-6c91-45e2-8c4c-d1c7bdcde76b
Dell Dridex Oct 2015ATTACK:enterprise:S0384 → uses → ATTACK:enterprise:T1518
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--41e8c16e-bfef-415f-b898-b76a1f527cc2
Checkpoint Dridex Jan 2021ATTACK:enterprise:S0384 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--43286c59-80a4-40d3-9aaa-ff7e6f321871
Kaspersky Dridex May 2017 · Checkpoint Dridex Jan 2021ATTACK:enterprise:S0384 → uses → ATTACK:enterprise:T1218.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4c29de08-20be-4358-acfd-c4939a83c14b
Red Canary Dridex Threat Report 2021ATTACK:enterprise:S0384 → uses → ATTACK:enterprise:T1573.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--68c412d7-9b6e-4a0e-a29f-69c1d8065156
Kaspersky Dridex May 2017ATTACK:enterprise:S0384 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6b8d8354-0fa9-4a45-8df9-57709beace42
Checkpoint Dridex Jan 2021ATTACK:enterprise:S0384 → uses → ATTACK:enterprise:T1090
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6f7ee9ba-fb3d-4f22-a78a-8003da718ec4
Dell Dridex Oct 2015 · Checkpoint Dridex Jan 2021ATTACK:enterprise:S0384 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9dfb9740-1641-4306-8ee8-38318be3ae42
Checkpoint Dridex Jan 2021ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:S0384
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aa4ac94c-705e-4215-8d52-a97b583b62c5
Crowdstrike Indrik November 2018 · Crowdstrike EvilCorp March 2021 · Treasury EvilCorp Dec 2019ATTACK:enterprise:S0384 → uses → ATTACK:enterprise:T1090.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e496b3d5-3608-49e6-9567-86b370abeeb3
Checkpoint Dridex Jan 2021ATTACK:enterprise:S0384 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e884cc7d-cea1-4ecc-84fb-5c31950b4357
Checkpoint Dridex Jan 2021