Zeus (malware)

Zeus is a Trojan horse malware package that runs on versions of Microsoft Windows. It is often used to steal banking information by man-in-the-browser keystroke logging and form grabbing. Zeus is spread mainly through drive-by downloads and phishing schemes. First identified in July 2007 when it was used to steal information from the United States Department of Transportation, it became more widespread in March 2009. In June 2009 security company Prevx discovered that Zeus had compromised over 74,000 FTP accounts on websites of such companies as the Bank of America, NASA, Monster.com, ABC, Oracle, Play.com, Cisco, Amazon, and BusinessWeek. Similarly to Koobface, Zeus has also been used to trick victims of technical support scams into giving the scam artists money through pop-up messages that claim the user has a virus, when in reality they might have no viruses at all. The scammers may use programs such as Command prompt or Event viewer to make the user believe that their computer is infected.

Detection

Zeus is very difficult to detect even with up-to-date antivirus and other security software as it hides itself using stealth techniques. It is considered that this is the primary reason why the Zeus malware then had become the largest botnet on the Internet: Damballa estimated that the malware infected 3.6 million PCs in the U.S. in 2009. Security experts are advising that businesses continue to offer training to users to teach them not to click on hostile or suspicious links in emails or Web sites, and to keep antivirus protection up to date. Antivirus software does not claim to reliably prevent infection; for example Symantec's Browser Protection says that it can prevent "some infection attempts".

FBI crackdown

In October 2010 the US FBI announced that hackers in Eastern Europe had managed to infect computers around the world using Zeus. The virus was distributed in an e-mail, and when targeted individuals at businesses and municipalities opened the e-mail, the trojan software installed itself on the victimized computer, secretly capturing passwords, account numbers, and other data used to log into online banking accounts.

The hackers then used this information to take over the victims’ bank accounts and make unauthorized transfers of thousands of dollars at a time, often routing the funds to other accounts controlled by a network of money mules, paid a commission. Many of the U.S. money mules were recruited from overseas. They created bank accounts using fake documents and false names. Once the money was in the accounts, the mules would either wire it back to their bosses in Eastern Europe, or withdraw it in cash and smuggle it out of the country.

More than 100 people were arrested on charges of conspiracy to commit bank fraud and money laundering, over 90 in the US, and the others in the UK and Ukraine. Members of the ring had stolen $70 million.

In 2013 Hamza Bendelladj, known as Bx1 online, was arrested in Thailand and deported to Atlanta, Georgia, USA. Early reports said that he was the mastermind behind ZeuS. He was accused of operating SpyEye (a bot functionally similar to ZeuS) botnets, and suspected of also operating ZeuS botnets. He was charged with several counts of wire fraud and computer fraud and abuse. Court papers allege that from 2009 to 2011 Bendelladj and others "developed, marketed, and sold various versions of the SpyEye virus and component parts on the Internet and allowed cybercriminals to customize their purchases to include tailor-made methods of obtaining victims’ personal and financial information". It was also alleged that Bendelladj advertised SpyEye on Internet forums devoted to cyber- and other crimes and operated Command and Control servers. The charges in Georgia relate only to SpyEye, as a SpyEye botnet control server was based in Atlanta.

In June 2014 the United States Department of Justice announced a multinational operation to disrupt Gameover Zeus, a peer-to-peer variant of Zeus that first appeared around September 2011. At the time, security researchers put the number of computers infected with Gameover Zeus at between 500,000 and 1 million worldwide, roughly 25 percent of them in the United States. The FBI attributed more than $100 million in losses to Gameover Zeus. Court orders obtained in federal court in Pittsburgh allowed the FBI to redirect infected computers' requests for instructions to substitute servers. The FBI could then collect the Internet Protocol addresses of those computers and pass them to US-CERT for sharing with other countries' emergency response teams and private industry to help victims remove the malware. A federal grand jury in Pittsburgh indicted Evgeniy Bogachev of Anapa, Russia, on 14 counts including conspiracy, computer hacking, wire fraud, bank fraud and money laundering over his alleged role as an administrator of the botnet, and he was separately charged in Omaha with conspiracy to commit bank fraud in connection with the earlier Jabber Zeus variant. In a related civil filing, the government identified him as a leader of a gang based in Russia and Ukraine that developed and ran both Gameover Zeus and the CryptoLocker ransomware. The same filing linked him to the online nicknames "Slavik" and "Pollingsoon". According to the criminal complaint filed in Omaha, he had also used the nickname "Lucky12345", which had been the subject of criminal charges filed in September 2012 and unsealed in April 2014.

In October 2022 Swiss police arrested the Ukrainian national Vyacheslav Penchukov, known as "Tank", in Geneva. In 2012 he had been accused of belonging to the JabberZeus crew, a small cybercrime group that attacked small and medium-sized businesses with a customised version of Zeus. At the time, prosecutors accused him of coordinating the exchange of stolen banking logins and money mules. They also said he received alerts when a victim's bank account had been compromised. Two other members of the crew, Yevhen Kulibaba and Yuriy Konovalenko, had been arrested in 2014; both pleaded guilty and in May 2015 each was sentenced to two years and ten months in prison. He had been on the FBI's "Most Wanted" list and had been sought for ten years. He was extradited to the United States in 2023, and in February 2024 he pleaded guilty to racketeering conspiracy and wire fraud conspiracy over his roles in the Zeus and IcedID malware operations. In July 2024 he was sentenced to nine years in federal prison, followed by three years of supervised release, and ordered to pay $73 million in restitution.

Possible retirement of creator

In late 2010, a number of Internet security vendors including McAfee and Internet Identity claimed that the creator of Zeus had said that he was retiring and had given the source code and rights to sell Zeus to his biggest competitor, the creator of the SpyEye trojan. However, those same experts warned the retirement was a ruse and expect the developer to return with new tricks.

See also

• Conficker
• Command and control (malware)
• Gameover ZeuS, the successor to ZeuS
• Jabber Zeus
• Operation Tovar
• Timeline of computer viruses and worms
• Tiny Banker Trojan
• Torpig
• Zombie (computer science)

References

External links

Wikinews has related news:

• Zeus botnet trojan horse is back

• "Measuring the in-the-wild effectiveness of Antivirus against Zeus" Study by Internet security firm Trusteer.
• "A summary of the ZeuS Bot" A summary of ZeuS as a Trojan and Botnet, plus vector of attacks.
• "The Kneber BotNet" by Alex Cox Archived 21 April 2022 at the Wayback Machine NetWitness Whitepaper on the Kneber botnet.
• "België legt fraude met onlinebankieren bloot" Dutch news article about a banking trojan
• "Indications in affected systems" Archived 8 January 2018 at the Wayback Machine Files and registry keys created by different versions of Zeus Trojan.
• Zeus, le dieu des virus contre les banques Archived 27 January 2022 at the Wayback Machine (in French)
• Zeus Bot's User Guide
• Zeus source code at GitHub
• Botnet Bust - SpyEye Malware Mastermind Pleads Guilty, FBI