What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
In October 2010, a report linked the banking Trojan Bugat to a LinkedIn-themed email campaign that had first been associated with Zeus. The reported lure used fake contact requests and a malicious link; a Java applet on the destination was said to download and install Bugat. That was a historical campaign, not evidence of a current threat. Later, Bugat v5 became known as Dridex, a related but distinct chapter in the malware’s history.
What was the Bugat Trojan?
Bugat was a Windows banking Trojan described by SecureWorks’ Counter Threat Unit (CTU) in 2010. CTU said it encountered a new sample in January of that year while its configuration was being updated with financial targets. The malware was designed to steal information useful to criminals seeking access to financial accounts, including browser data and credentials. SecureWorks CTU’s Bugat analysis documents capabilities found in the early malware they examined.
As an Amazon Associate I earn from qualifying purchases.
Those capabilities should be understood as observations about analyzed samples, not a checklist guaranteed to appear in every Bugat version. The name also spans different periods: early Bugat and the later Bugat v5/Dridex are not interchangeable when describing their delivery methods or components.
How did Bugat spread through LinkedIn emails?
SecurityWeek reported on September 27, 2010, that a spam campaign impersonated LinkedIn contact-request notifications and was initially associated with Zeus. An October 12 update to that report said Bugat had also been reported in the attack. In a separate October 12 story, SecurityWeek relayed Trusteer’s claim that a new Bugat version was involved. The account described fake “Contact Request” emails directing recipients to a malicious URL, where a Java applet fetched and installed the Trojan. SecurityWeek’s campaign report and update and its October 12 Bugat report describe the claims at the time.
#1 Best Overall
The qualification matters: the original campaign coverage focused on Zeus before being updated to mention Bugat. The reports do not establish that every message in the campaign delivered Bugat, or that this 2010 Java-applet route describes later Dridex distribution.
What could early Bugat steal or do?
CTU’s analysis described a banking Trojan with functions extending beyond capturing a password typed into a login form. Depending on the analyzed sample and configuration, reported capabilities included:
- Capturing form data in Internet Explorer and Firefox, including information entered on targeted financial sites.
- Scraping or modifying HTML on selected sites, which could let the malware interfere with what a victim saw or submitted.
- Stealing and deleting Internet Explorer, Firefox, and Flash cookies, along with FTP and POP account credentials.
- Using the infected computer as a SOCKS proxy, browsing files, and uploading them.
- Downloading and running programs, and reporting lists of running processes to its operators.
CTU said the early malware communicated with a remote command-and-control web server, received URL target strings, and could use HTTPS. These are technical findings from the early samples, not proof that all variants used every function in the same way.
Is Bugat the same as Dridex?
Bugat v5 was later identified as Dridex. Sophos’ CTU retrospective treats that later version as a separate phase in the malware’s evolution, rather than as the exact LinkedIn-delivered Trojan described in 2010. Sophos CTU’s retrospective on the Dridex botnet describes its architecture, distribution, and disruption in 2015.
How Bugat v5/Dridex differed in the later reporting
- Modular design: CTU described four main components: a loader, core DLL, VNC module, and backconnect module.
- Distribution: In 2015-era observations, CTU saw Cutwail spam carrying Word or Excel documents with malicious macros. That is not the same delivery chain as the Java applet reported in 2010.
- Network structure: CTU described a hybrid peer-to-peer design, with traffic tunneled largely to backend infrastructure, and a botnet affiliate model.
- Additional payload: CTU observed Bugat v5 dropping Kegotip, a credential-stealing malware.
What happened to the botnet in 2015?
CTU reported that in fall 2015 it collaborated with the UK National Crime Agency, the FBI, and the Shadowserver Foundation in an effort to take over Bugat v5 infrastructure. The retrospective also says the botnet re-emerged and rebuilt infrastructure afterward. That history shows why an infrastructure disruption should not be mistaken for proof that every infected system was cleaned or that the malware could never return.
Is the Bugat Trojan still active today?
The cited 2010 and 2015 accounts do not establish whether Bugat or Dridex is active now, how prevalent either is, or how current endpoint products detect them. They support a historical account of early Bugat and Bugat v5/Dridex, not a present-day threat assessment.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What should you do with a suspicious contact request?
The 2010 lure is a reminder to verify unexpected account notifications through the service’s own website or app rather than following a link in an email. General precautions that remain useful for suspicious messages include:
Free tools Windows power users keep installed
One-click scans. No signup required.
- Check the sender and destination address carefully; do not enter credentials after following an unexpected email link.
- Do not open unexpected Office attachments or enable macros just to view a document.
- Keep operating systems, browsers, and protective software updated.
- If you suspect business or banking credentials were exposed, contact the relevant bank or service promptly, change credentials from a trusted device, and follow its account-security guidance.
These are general defensive steps, not a claim that a particular product detects or removes Bugat.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
