MalwareUsed by 1 actor

Jabberzeus

JabberZeuS is a customized ZeuS-derived banking trojan associated with the Business Club cybercriminal ecosystem and the broader lineage that later included GameOverZeuS. It was developed as a bespoke variant of ZeuS for a criminal gang that maintained direct contact with the ZeuS author. A defining feature of JabberZeuS was its use of the XMPP/Jabber protocol to send real-time notifications to operators when an infected victim accessed a bank account meeting attacker-defined criteria, enabling rapid cash-out operations through coordinated money-mule networks.

Its primary purpose was theft of online banking credentials and facilitation of fraudulent transfers, particularly against businesses in the United States and Europe. Operationally, JabberZeuS formed part of an organized fraud workflow in which stolen credentials were relayed to operators and accomplices managed mule recruitment and fund extraction. The malware is historically significant as an intermediate stage in the evolution from ZeuS to GameOverZeuS, and reporting on the Business Club and Evil Corp lineages places JabberZeuS within the criminal development arc that influenced later large-scale banking malware operations.

High-confidence reporting supports JabberZeuS as a Windows-focused banking trojan used for credential theft and post-compromise fraud enablement. Specific initial infection vectors are not established here with sufficient confidence.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

INDRIK SPIDER

Cette version, agrémentée de l’utilisation du protocole XMPP, sera baptisée JabberZeuS.

via cert ssicert.ssi.gouv.fr

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

The JabberZeus crew’s name is derived from the malware they used, which was configured to send them a Jabber instant message each time a new victim entered a one-time password code into a phishing page mimicking their bank.

Persistence

1 technique

T1556Modify Authentication ProcessEvidence1

Privilege Escalation

1 technique

T1055Process InjectionEvidence1

the government believes is responsible for building and distributing the ZeuS banking Trojan . Bogachev is thought to be a core architect of ZeuS, a malware strain that has been used to steal hundreds of millions of dollars from bank accounts

Stealth

1 technique

T1055Process InjectionEvidence1

Defense Impairment

1 technique

T1556Modify Authentication ProcessEvidence1

Credential Access

2 techniques

T1056Input CaptureEvidence1

infected tens of millions of computers, harvested huge volumes of sensitive financial data

T1556Modify Authentication ProcessEvidence1

Collection

3 techniques

T1056Input CaptureEvidence1

infected tens of millions of computers, harvested huge volumes of sensitive financial data

T1185Browser Session HijackingEvidence1

The JabberZeus gang targeted mostly small to mid-sized businesses, and they were an early pioneer of so-called “man-in-the-browser” attacks, malware that can silently siphon any data that victims submit via a web-based form.

T1213Data from Information RepositoriesEvidence1

it became clear Tank was nominally in charge of the Ukrainian crew, and that he spent much of his time overseeing the activities of the money mule recruiters — which were an integral part of their victim cashout scheme.

Command and Control

1 technique

T1071.001Web ProtocolsEvidence1

The “jabber” part of the name is a reference to a key feature of the malware that would send an Jabber instant message to members of the gang anytime a new victim logged into a bank account that had a high balance.

Impact

1 technique

T1657Financial TheftEvidence1

Once inside a victim company’s bank accounts, the crooks would modify the firm’s payroll to add dozens of “ money mules ,” people recruited through work-at-home schemes to handle bank transfers.

Other

1 technique

T1562Impair DefensesEvidence1

the ZeuS author declined to help them keep it undetectable by commercial antivirus tools... he refuses to write bypass of [anti-malware] scans

ACTIVITY FEED

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

5 SOURCESView more in app

krebs on securityNews

Feb 25, 2015

FBI: $3M Bounty for ZeuS Trojan Author - Krebs on Security

Custom ZeuS variant built for a cybercrime gang. A notable feature was sending Jabber instant messages when a victim logged into a bank account with a high balance, enabling rapid theft operations.

cert ssiNews

Aug 14, 2026

Enhanced ZeuS variant used by the Business Club/Evil Corp precursor, notable for XMPP-based notifications about compromised banking sessions; included as part of the lineage leading to Dridex operators.

cert ssiNews

Aug 14, 2026

Historical Zeus-family malware mentioned as part of the lineage of actors tied to Emotet's origins.

cert ssiNews

Aug 14, 2026

Banking trojan mentioned only as historical background to TrickBot lineage.

+1 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Jabberzeus