View source for The Cridex trojan targets 137 financial organizations in one go

{{Publication
|Image=m86security_cridex_cnc.png
|Legend=
|Document=
|Licence=
|Video=
|Link=http://labs.m86security.com/2012/03/the-cridex-trojan-targets-137-financial-organizations-in-one-go/ labs.m86security.com
|Author=Daniel Chechik, 
|NomRevue=M86 Security Labs Blog
|Date=March 1st, 2012
|Editor=M86 Security Labs
|Year=2012
|ISBN=
|Page=
|Abstract=A few weeks ago M86 Security Labs alerted that cybercriminals managed to compromise hundreds of WordPress-based sites. These attacks started with several large spam campaigns as reported in our most recent blog post on Cutwail. These emails included embedded URL links or HTML attachments that tricked the user to browse to the compromised Web sites. All these links eventually lead to Web pages infected with the Phoenix exploit kit. These cybercriminals operate Fast flux networks, which are a DNS technique used by botnets to hide the main C&C servers.

After the target machine is successfully exploited, the Phoenix exploit kit downloads a Trojan to the victim’s machine. The downloaded Trojan is recognized by antivirus vendors under several names such as Cridex, Carberp and Dapato. Antivirus detection is quite low and only ten out of 43 antivirus scanners in VirusTotal can detect it.
|Botnet=Cridex, ZeuS, SpyEye, Carberp, 
|Malware=Cridex (bot), Carberp (bot), Dapato, 
|ExploitKit=Phoenix
|CCProtocol=, 
|Operation=, 
|Keyword=FastFlux, 
}}