Trusted Design

Malicious Office files dropping Kasidet and Dridex

概要

[Zscaler] has covered Dridex Banking Trojan being delivered via various campaigns involving Office documents with malicious VBA macros in the past. However, over the past two weeks we are seeing these malicious VBA macros leveraged to drop Kasidet backdoor in addition to Dridex on the infected systems. These malicious Office documents are being spread as an attachment using spear phishing emails as described here. The malicious macro inside the Office document is obfuscated as shown in the code snapshot below -

Created: 2026-02-23

Indicators

• URL - http://armandosofsalem.com/l9k7hg4/b4387kfd.exe -
• URL - http://188.226.152.172/l9k7hg4/b4387kfd.exe -
• URL - http://trinity.ad-ventures.es/l9k7hg4/b4387kfd.exe -

類似Pulses

• New Dridex infection vector identified (score: 0.76)
• Evoltin POS Malware Attacks via Macro (score: 0.68)
• Dridex, Vawtrak and others increase focus on Canada (score: 0.68)
• Signed Dridex Campaign (score: 0.68)
• Banking Trojan DRIDEX (score: 0.67)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る