Jabber Zeus
Jabber Zeus is a banking Trojan and associated cybercriminal operation active primarily around 2009 to 2010. It is described as the second main iteration of Zeus, succeeding Zeus and preceding Gameover Zeus, and is also referred to in the content as ZeuS 2.1.0.X, Licat, and Murofet. The malware was used by a syndicate based in Russia, Ukraine, and the United Kingdom to target small businesses via spam emails, steal online banking credentials and one-time passwords, and exfiltrate stolen data in real time over the Jabber protocol. The operation then laundered proceeds through a large money mule network reported as exceeding 3,500 mules. The content attributes primary development of Jabber Zeus to Evgeniy Bogachev, with Vyacheslav Penchukov coordinating stolen credential movement and mule operations, and Maksim Yakubets managing mule recruitment; another alleged developer/operator identified as MrICQ is Yuriy Igorevich Rybtsov. Reported enhancements added in September 2010 included a domain generation algorithm, regular expression support, file infection capability, and encrypted distribution, with each copy requiring a $10,000 encryption key purchased by Penchukov. The botnet was used for large-scale financial theft, with at least $70 million reportedly stolen, and the content also states it was suspected of supporting espionage activity in Georgia, Turkey, and Ukraine. Law-enforcement reporting in the content links the malware and group to Operation Trident Breach, a joint action involving U.S., U.K., Ukrainian, Dutch, and Russian agencies, after which the operation was disrupted and later re-emerged as Gameover Zeus. High-confidence behavioral indicators from the content are spam-based delivery, theft of banking credentials and OTPs, real-time Jabber-based exfiltration, botnet operation, DGA use, encrypted distribution, and file infection capability.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Jabber Zeus is a variant of the Zeus banking trojan, used to steal banking credentials and facilitate financial fraud. It is associated with a cybercrime group involved in large-scale credential theft and money laundering.
Banking trojan used for bank account theft and later associated with the rise of ransomware operations.
Jabber Zeus is a variant of the Zeus banking Trojan, primarily used to steal banking credentials and one-time passwords from victims, especially small businesses, via spam emails. It exfiltrated data in real-time using the Jabber protocol and formed a botnet for remote control. The stolen funds were laundered through a network of money mules. The malware also included enhancements such as a domain generation algorithm, regular expression support, and file infection capabilities. There is evidence it was also used for espionage.
Zeus-family banking trojan variant referenced in the context of law-enforcement action against an alleged developer/coder.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.