{ "id": "e54c9c2d-387b-4039-98d8-7694993b72ef", "created_at": "2026-04-06T00:18:47.35132Z", "updated_at": "2026-04-10T13:11:22.054865Z", "deleted_at": null, "sha1_hash": "50c174223db9c85056bd626e673e09c5e91ec67e", "title": "Log4j vulnerability now used to install Dridex banking malware", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 4584170, "plain_text": "Log4j vulnerability now used to install Dridex banking malware\r\nBy Lawrence Abrams\r\nPublished: 2021-12-20 · Archived: 2026-04-05 14:29:01 UTC\r\nThreat actors now exploit the critical Apache Log4j vulnerability named Log4Shell to infect vulnerable devices with the\r\nnotorious Dridex banking trojan or Meterpreter.\r\nThe Dridex malware is a banking trojan originally developed to steal online banking credentials from victims. However,\r\nover time, the malware has evolved to be a loader that downloads various modules that can be used to perform different\r\nmalicious behavior, such as installing additional payloads, spreading to other devices, taking screenshots, and more.\r\nDridex infections are also known to lead to ransomware attacks from operations believed to be linked to the Evil Corp\r\nhacking group. These ransomware infections include BitPaymer, DoppelPaymer, and possibly other limited-use ransomware\r\nvariants.\r\nhttps://www.bleepingcomputer.com/news/security/log4j-vulnerability-now-used-to-install-dridex-banking-malware/\r\nPage 1 of 7\n\n0:00\r\nhttps://www.bleepingcomputer.com/news/security/log4j-vulnerability-now-used-to-install-dridex-banking-malware/\r\nPage 2 of 7\n\nVisit Advertiser websiteGO TO PAGE\r\nLog4j exploited to install Dridex and Meterpreter\r\nToday, the cybersecurity research group Cryptolaemus warned that the Log4j vulnerability is now exploited to infect\r\nWindows devices with the Dridex Trojan and Linux devices with Meterpreter.\r\nCryptolaemus member Joseph Roosen told BleepingComputer that the threat actors use the Log4j RMI (Remote Method\r\nInvocation) exploit variant to force vulnerable devices to load and execute a Java class from an attacker-controlled remote\r\nserver.\r\nLog4j RMI exploit to execute Dridex loader\r\nSource: BleepingComputer\r\nWhen executed, the Java class will first attempt to download and launch an HTA file from various URLs, which will install\r\nthe Dridex trojan. If it cannot execute the Windows commands, it will assume the device is running Linux/Unix and\r\ndownload and execute a Python script to install Meterpreter.\r\nRunning Meterpreter on a Linux box will provide the threat actors with a remote shell that they can use to deploy further\r\npayloads or execute commands.\r\nThe Dridex threat actors are known for using racial and religious slurs in their file names and URLs, which\r\nBleepingComputer has redacted from the images below.\r\nhttps://www.bleepingcomputer.com/news/security/log4j-vulnerability-now-used-to-install-dridex-banking-malware/\r\nPage 3 of 7\n\nDecompiled Java class executed by Log4j exploit\r\nSource: BleepingComputer\r\nOn Windows, the Java class will download an HTA file and open it, which will cause a VBS file to be created in the\r\nC:\\ProgramData folder. This VBS file acts as the main downloader for Dridex and has been seen previously in other Dridex\r\nemail campaigns.\r\nHTA file downloaded by Java class\r\nSource: BleepingComputer\r\nhttps://www.bleepingcomputer.com/news/security/log4j-vulnerability-now-used-to-install-dridex-banking-malware/\r\nPage 4 of 7\n\nWhen executed, the VBS file will check if the user is part of a Windows domain by checking various environment variables.\r\nIf the user is part of a domain, the VBS file will download the Dridex DLL and execute it using Rundll32.exe, as shown\r\nbelow.\r\nRundll loading the Dridex DLL in Windows\r\nSource: BleepingComputer\r\nAs previously said, if the original Java class exploit is unable to launch the Windows commands, it will assume the\r\noperating is a Unix/Linux device and download an 'm.py' python script instead.\r\nhttps://www.bleepingcomputer.com/news/security/log4j-vulnerability-now-used-to-install-dridex-banking-malware/\r\nPage 5 of 7\n\nm.py python script executed on Linux devices\r\nSource: BleepingComputer\r\nThe above script contains a base64 encoded script that will be executed to install Meterpreter, a pentesting tool that provides\r\na reverse shell back to the threat actors.\r\nDeobfuscated script installing Meterpreter\r\nSource: BleepingComputer\r\nUsing Meterpreter, the threat actors can connect to the compromised Linux server and remotely execute commands to spread\r\nfurther on the network, steal data, or deploy ransomware.\r\nWith Log4j exploited by threat actors to install a wide range of malware, it comes as no surprise that the more active\r\nmalware operations would begin to target the vulnerability.\r\nWe should expect to see other malware operations begin to utilize the vulnerability to compromise servers and internal\r\ncorporate networks. Therefore, it is strongly advised that all organizations scan for vulnerable applications that use Log4j\r\nand update them to the latest versions.\r\nThis includes updating Log4j to the latest version, now version 2.17, released this Saturday to fix a new denial of service\r\nvulnerability.\r\nThere are many Log4j scanners available that can be used to find vulnerable applications, including a new local\r\nscanner from the Profero security.\r\nhttps://www.bleepingcomputer.com/news/security/log4j-vulnerability-now-used-to-install-dridex-banking-malware/\r\nPage 6 of 7\n\nAutomated Pentesting Covers Only 1 of 6 Surfaces.\r\nAutomated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the\r\nother.\r\nThis whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic\r\nquestions for any tool evaluation.\r\nSource: https://www.bleepingcomputer.com/news/security/log4j-vulnerability-now-used-to-install-dridex-banking-malware/\r\nhttps://www.bleepingcomputer.com/news/security/log4j-vulnerability-now-used-to-install-dridex-banking-malware/\r\nPage 7 of 7", "extraction_quality": 1, "language": "EN", "sources": [ "Malpedia", "ETDA" ], "origins": [ "web" ], "references": [ "https://www.bleepingcomputer.com/news/security/log4j-vulnerability-now-used-to-install-dridex-banking-malware/" ], "report_names": [ "log4j-vulnerability-now-used-to-install-dridex-banking-malware" ], "threat_actors": [ { "id": "d90307b6-14a9-4d0b-9156-89e453d6eb13", "created_at": "2022-10-25T16:07:23.773944Z", "updated_at": "2026-04-10T02:00:04.746188Z", "deleted_at": null, "main_name": "Lead", "aliases": [ "Casper", "TG-3279" ], "source_name": "ETDA:Lead", "tools": [ "Agentemis", "BleDoor", "Cobalt Strike", "CobaltStrike", "RbDoor", "RibDoor", "Winnti", "cobeacon" ], "source_id": "ETDA", "reports": null }, { "id": "50068c14-343c-4491-b568-df41dd59551c", "created_at": "2022-10-25T15:50:23.253218Z", "updated_at": "2026-04-10T02:00:05.234464Z", "deleted_at": null, "main_name": "Indrik Spider", "aliases": [ "Indrik Spider", "Evil Corp", "Manatee Tempest", "DEV-0243", "UNC2165" ], "source_name": "MITRE:Indrik Spider", "tools": [ "Mimikatz", "PsExec", "Dridex", "WastedLocker", "BitPaymer", "Cobalt Strike" ], "source_id": "MITRE", "reports": null }, { "id": "b296f34c-c424-41da-98bf-90312a5df8ef", "created_at": "2024-06-19T02:03:08.027585Z", "updated_at": "2026-04-10T02:00:03.621193Z", "deleted_at": null, "main_name": "GOLD DRAKE", "aliases": [ "Evil Corp", "Indrik Spider ", "Manatee Tempest " ], "source_name": "Secureworks:GOLD DRAKE", "tools": [ "BitPaymer", "Cobalt Strike", "Covenant", "Donut", "Dridex", "Hades", "Koadic", "LockBit", "Macaw Locker", "Mimikatz", "Payload.Bin", "Phoenix CryptoLocker", "PowerShell Empire", "PowerSploit", "SocGholish", "WastedLocker" ], "source_id": "Secureworks", "reports": null }, { "id": "9806f226-935f-48eb-b138-6616c9bb9d69", "created_at": "2022-10-25T16:07:23.73153Z", "updated_at": "2026-04-10T02:00:04.729977Z", "deleted_at": null, "main_name": "Indrik Spider", "aliases": [ "Blue Lelantos", "DEV-0243", "Evil Corp", "G0119", "Gold Drake", "Gold Winter", "Manatee Tempest", "Mustard Tempest", "UNC2165" ], "source_name": "ETDA:Indrik Spider", "tools": [ "Advanced Port Scanner", "Agentemis", "Babuk", "Babuk Locker", "Babyk", "BitPaymer", "Bugat", "Bugat v5", "Cobalt Strike", "CobaltStrike", "Cridex", "Dridex", "EmPyre", "EmpireProject", "FAKEUPDATES", "FakeUpdate", "Feodo", "FriedEx", "Hades", "IEncrypt", "LINK_MSIEXEC", "MEGAsync", "Macaw Locker", "Metasploit", "Mimikatz", "PayloadBIN", "Phoenix Locker", "PowerShell Empire", "PowerSploit", "PsExec", "QNAP-Worm", "Raspberry Robin", "RaspberryRobin", "SocGholish", "Vasa Locker", "WastedLoader", "WastedLocker", "cobeacon", "wp_encrypt" ], "source_id": "ETDA", "reports": null }, { "id": "6c4f98b3-fe14-42d6-beaa-866395455e52", "created_at": "2023-01-06T13:46:39.169554Z", "updated_at": "2026-04-10T02:00:03.23458Z", "deleted_at": null, "main_name": "Evil Corp", "aliases": [ "GOLD DRAKE" ], "source_name": "MISPGALAXY:Evil Corp", "tools": [], "source_id": "MISPGALAXY", "reports": null } ], "ts_created_at": 1775434727, "ts_updated_at": 1775826682, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/50c174223db9c85056bd626e673e09c5e91ec67e.pdf", "text": "https://archive.orkl.eu/50c174223db9c85056bd626e673e09c5e91ec67e.txt", "img": "https://archive.orkl.eu/50c174223db9c85056bd626e673e09c5e91ec67e.jpg" } }