IBM has released details of an international cyberattack that stole more than $1 million from U.S. corporate accounts. The operation was dubbed “The Dyre Wolf,” after the Dyre malware used .
Last October, US-CERT warned that malware was being used in spear phishing attacks, in which crooks tried to extort money from their victims. In the campaign disclosed by IBM, attackers often used fake invoices containing hidden malware to trick their victims.
The file inside the zip attachment contained a PDF, while in reality it was an EXE or SCR file. Once opened, it would start running Upatre, which in turn would download Dyre.
Once Dyre is installed, Upatre automatically removes itself from the system and takes over Dyre. Dyre’s password-stealing functionality is the target of this attack, and in this way, money is transferred directly from the user’s account to the accounts of the fraudsters. The installation and operation of Dyre, like Upatre, remains hidden from the user. It also connects and closely monitors the user’s activity in the browser they are using, in order to steal their credentials as soon as it detects that the user has visited a banking website. In many cases, due to 2FA, it used advanced social engineering features.
When the user visits a bank website, out of the hundreds that Dyre is programmed to monitor, they will receive a message that the website is experiencing a technical problem and will be shown a contact number for help. The user will call this number, but on the other end of the line there will not be a representative of the bank, but a third party who will request and receive all the credentials for supposedly confirming the account. From there, transferring money is a matter of seconds.
