What is Dridex (Bugat) Malware?

Dridex (Bugat) Malware

malware OpenTrojan Threat Intelligence Updated 2026-08-26

Banking credentials; global botnet for follow-on malware

Source Attribution

Origin: MITRE
Source: CISA · NCA takedown 2021
Reviewer: Phase 44E review
Verified: 2026-08-26T15:16:26.825Z
Confidence: high

Source: CISA · NCA takedown 2021 · Verified: 2026-08-26T15:16:26.825Z · Confidence: high

Security Timeline

2011-10 discovered Dridex (Bugat) variant observed
2021-10 updated Coordinated takedown disrupted infrastructure

Quick Answer

Dridex spreads via malicious documents and macro attachments, maintaining a global botnet with banking fraud and loader modules.

Definition

Dridex is a long-running banking trojan (successor to Cridex/Bugat) that steals credentials via web-injects and has loaded ransomware including BitPaymer and DoppelPaymer.

Overview

Dridex is a long-running banking trojan (successor to Cridex/Bugat) that steals credentials via web-injects and has loaded ransomware including BitPaymer and DoppelPaymer.

Behavior

Web-inject banking fraud
Loader for BitPaymer/DoppelPaymer
2021 NCA-coordinated takedown

First Seen

2011-10

Target

Banking credentials; global botnet for follow-on malware

Techniques: T1566, T1185, T1071
Campaigns: n/a
Related CVEs: n/a

Malware Intelligence

Family: Dridex (Bugat) Malware

Aliases: Dridex, Bugat, Cridex

Techniques: T1566, T1185, T1071

Targets: Banking credentials; global botnet for follow-on malware

Behavior:

Web-inject banking fraud
Loader for BitPaymer/DoppelPaymer
2021 NCA-coordinated takedown

References

Have a follow-up question?

Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.

Ask AI about this Start an investigation

Start Investigation

Move from reading to investigating Dridex (Bugat) Malware. The workspace is a structured analysis surface — not a chat — organised as:

Question — what do you need to know about Dridex (Bugat) Malware?

Evidence — assertions mapped to verifiable references.

Timeline — events in chronological order.

Related Entities — CVE, threat actor, campaign, malware links.

Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.

Notes — your own observations and working hypotheses.

AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.