Gameover ZeuS
GameOver Zeus (GOZ), also referred to as peer-to-peer Zeus or P2P Zeus, is a Zeus-based banking trojan and botnet malware family active in the wild from September 2011 until its major disruption in May/June 2014. It primarily targeted Microsoft Windows systems and was used to steal banking and other online credentials from infected computers. Reported infection vectors included spam and phishing emails, malicious links and attachments, compromised websites, and drive-by installation via outdated browser plugins. The malware captured credentials through keystroke logging, man-in-the-browser attacks, and browser/web injects that altered legitimate banking pages and solicited additional sensitive data such as Social Security numbers and credit card numbers.
A defining characteristic of GameOver Zeus was its decentralized, encrypted command-and-control architecture. Unlike earlier Zeus variants that relied on centralized servers, GOZ used a peer-to-peer network of infected hosts, proxy nodes, and web servers for command and control, malware updates, configuration distribution, and exfiltration of stolen data. This architecture made disruption more difficult and removed a single point of failure. The malware also used domain generation algorithms (DGA); reporting cited variants generating 1,000 or 10,000 domains per day, with infected hosts contacting generated domains regularly to locate command infrastructure.
Beyond credential theft, infected systems were used as part of a botnet for spam distribution and distributed denial-of-service attacks. Multiple sources state that GOZ operators used DDoS attacks against victims and their banks shortly after thefts. The malware also had the capability to install additional payloads and was one of the primary delivery mechanisms for CryptoLocker ransomware. Authorities stated that GOZ and CryptoLocker together infected hundreds of thousands of computers worldwide, and that CryptoLocker was deployed onto numerous GOZ-infected systems.
The malware is strongly associated with Russian national Evgeniy Mikhailovich Bogachev, also known as Slavik, lucky12345, and Pollingsoon, who was identified by U.S. authorities as a leader/administrator of the criminal enterprise behind GOZ. Reporting also linked GOZ operations to a core criminal group sometimes referred to as the "Business Club," with associates in Russia and Ukraine. Some reporting further stated that a GameOver Zeus strain was configured to collect security-related documents in Georgia, Turkey, and Ukraine, and that researchers observed searches on infected systems for intelligence- and geopolitics-related material; however, these espionage-related uses were described in reporting about operator activity rather than as core malware functionality.
GameOver Zeus was assessed to have infected roughly 500,000 to more than 1 million computers globally and to have caused losses exceeding $100 million. Victims included businesses and financial institutions in the United States and Europe, with cited cases involving unauthorized wire transfers against companies, a tribe, and a regional bank. Public reporting and court documents also described specific phishing lures spoofing organizations such as NACHA and noted use of money mules to receive stolen funds and move them overseas.
Known operational and investigative details include its use against hacked Microsoft Windows computers, peer/proxy-based C2, DGA-based fallback communications, and its role as a distribution platform for CryptoLocker. A major multinational law-enforcement and private-sector disruption effort, Operation Tovar, seized control of the botnet in 2014.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
GameOver ZeuS, GOZ, peer-to-peer ZeuS, P2P-ZeuS and ZeuS3 are analogous to each other and refer to a ZeuS based malware family, which was active in the wild from September 2011 till May 2014.
"...operated the Zeus and Gameover Zeus botnets until international law enforcement action in May 2014."
"...operated the Zeus and Gameover Zeus botnets until international law enforcement action in May 2014."
Techniques & procedures
30 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
2 techniques
Resource Development
Initial Access
4 techniques
Initial Access
The links in the email have been replaced with those of compromised sites that will silently probe the visitor’s browser for outdated plugins that can be leveraged to install malware.
According to a 2012 research paper published by Dell SecureWorks, the Gameover Trojan is principally spread via Cutwail, one of the world’s largest and most notorious spam botnets... These junk emails typically spoof trusted brands... The email lures bearing Gameover often come in the form of an invoice, an order confirmation, or a warning about an unpaid bill.
Execution
1 technique
Execution
Privilege Escalation
1 technique
Privilege Escalation
Stealth
2 techniques
Stealth
Credential Access
6 techniques
Credential Access
The principal purpose of GOZ is to capture banking credentials from infected computers. One means by which GOZ accomplishes this is through ... attacks, in which GOZ intercepts sensitive information victims transmit from their computers.
others used it just as a piece of malware to log information that ZeuS collected from victims from either the keystroke logging, or the built-in POST data logging
the Defendants use GOZ to inject additional code into victims' web browsers that changes the appearance of the websites victims are viewing. For example, if a GOZ-infected user were to visit a banking website that typically requests only a username and password, the defendants could seamlessly inject additional form fields into the website displayed in the user's web browser that also request the user's social security number, credit card numbers, and other sensitive information.
In 2007 the first large scale attacks took place, that used the ZeuS bank attack configuration called “webinjects”... While ZeuS is a versatile malware kit... its key strength is in browser manipulation through the use of its dynamic configuration.
Discovery
1 technique
Discovery
Collection
7 techniques
Collection
During our research, we found a large amount of search queries which were executed on the victim systems. The search queries consisted of a number of keywords... focused on locating “government classified” material
The principal purpose of GOZ is to capture banking credentials from infected computers. One means by which GOZ accomplishes this is through ... attacks, in which GOZ intercepts sensitive information victims transmit from their computers.
others used it just as a piece of malware to log information that ZeuS collected from victims from either the keystroke logging, or the built-in POST data logging
the Defendants use GOZ to inject additional code into victims' web browsers that changes the appearance of the websites victims are viewing. For example, if a GOZ-infected user were to visit a banking website that typically requests only a username and password, the defendants could seamlessly inject additional form fields into the website displayed in the user's web browser that also request the user's social security number, credit card numbers, and other sensitive information.
In 2007 the first large scale attacks took place, that used the ZeuS bank attack configuration called “webinjects”... While ZeuS is a versatile malware kit... its key strength is in browser manipulation through the use of its dynamic configuration.
The token-grabber attack in peer-to-peer ZeuS... The victim would see a normal, or almost normal, login page of their bank... During the victim being on hold, the browser would continuously poll the backend to check if new questions were available to ask the victim.
Command and Control
8 techniques
Command and Control
Individual infected computers, or "bots," are controlled remotely through a decentralized command and control ("C&C") system in which (a) ordinary infected computers, or "peers," remain in contact with each other; (b) specially selected peers called "proxy nodes" transmit commands and other information from the Defendants to the peers; and (c) a Domain Generation Algorithm ("DGA") is used to generate a large number of Internet domain names with which the infected computers communicate at least once a week.
It uses a tiered, decentralized system of intermediary proxies and strong encryption to hide the location of servers that the botnet masters use to control the crime machine.
Apart from the peer-to-peer network, which was only the first layer, there were additional layers of proxies, which protected the real IP addresses of the backends from becoming known. Even the users of the malware would log in to the individual backends via a proxy
It will be interesting to hear how the authorities and security researchers involved in this effort managed to gain control over the Gameover botnet, which uses an advanced peer-to-peer (P2P) mechanism to control and update the bot-infected systems.
GOZ includes code that permits the defendants to install additional malicious software onto computers infected with GOZ. The defendants and their co-conspirators have used this capability to install Cryptolocker onto numerous computers within the GOZ botnet.
bot_bc_add vnc <ip> <port> ... Most of these commands are used... to... connect to the victim’s desktop... One specific plugin that was seen, was a VNC component before the plugin VNC was actually built into the malware itself.
Exfiltration
1 technique
Exfiltration
IOCs tracked for this family
27 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
36 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Zeus-derived banking trojan botnet that uses DGA-based C2 communications to evade disruption and steal banking credentials and funds from victims’ accounts.
Zeus-derived botnet referenced as operated by GOLD EVERGREEN/The Business Club until May 2014 law enforcement action.
Zeus-derived botnet referenced as operated by GOLD EVERGREEN/The Business Club until May 2014 law enforcement action.
Referenced as a related banking malware family with shared code/infrastructure similarities to Dridex.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.