{
  "family": "cridex",
  "sample_count": 1,
  "category": "trojan",
  "description": "<h3>Executive Summary</h3>\nCridex is a highly influential banking trojan and worm that emerged in 2011, notorious for being the direct predecessor to the devastating Dridex botnet. Designed for aggressive financial theft, Cridex infected systems to harvest banking credentials, intercept secure web sessions, and rapidly propagate across local networks and removable media, causing massive financial losses in the early 2010s.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nCridex utilized a multi-pronged distribution strategy, primarily leveraging massive spam campaigns containing malicious attachments (often ZIP files containing executable droppers) and drive-by downloads via the Blackhole Exploit Kit.\n\nOnce active, Cridex combined the espionage capabilities of a banking trojan with the spread of a worm:\n<ul>\n<li><strong>Web Injection (Man-in-the-Browser):</strong> Cridex's primary weapon was its ability to inject malicious HTML and JavaScript directly into the user's web browser in real-time (MitB). When a victim visited a targeted banking portal, Cridex would alter the login page, requesting additional sensitive information (like ATM PINs or mother's maiden name) and bypassing two-factor authentication.</li>\n<li><strong>Worm Propagation:</strong> Unlike modern banking trojans, Cridex actively sought to spread. It monitored the system for newly inserted USB flash drives, copying itself and creating an `AutoRun.inf` file. It also attempted to spread across open SMB network shares using weak or stolen credentials.</li>\n<li><strong>Peer-to-Peer (P2P) Architecture:</strong> Later variants of Cridex experimented with a P2P command-and-control (C2) architecture. Instead of relying on a centralized server that could be easily taken down, infected nodes communicated with each other to distribute configuration files and exfiltrate stolen data.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Cridex infection represents a critical security incident resulting in immediate financial risk. The theft of banking credentials combined with the worm's ability to rapidly infect an entire corporate network makes it a highly destructive threat that requires immediate containment.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Immediate Network Segmentation:</strong> Physically or logically segment the infected endpoint and its surrounding VLAN to halt the lateral spread of the worm via SMB shares.</li>\n<li><strong>Credential Reset and Fraud Alert:</strong> All financial institutions accessed from the infected machine must be notified immediately. All session tokens and credentials must be revoked and reset.</li>\n<li><strong>Disable AutoRun:</strong> Ensure enterprise-wide Group Policy Objects (GPOs) completely disable AutoRun and AutoPlay to prevent the USB propagation vector.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Worm.Cridex",
    "Trojan.Cridex",
    "W32/Cridex"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1056.004",
    "T1091",
    "T1185",
    "T1566.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T17:06:28Z",
  "type": "Banking Trojan / Worm",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}