Loading story…
Check Point Research reported that Gozi has remained a persistent banking malware threat by repeatedly reappearing in new forms and criminal operations. The malware family, also known through variants such as Ursnif, has been used to steal banking credentials and other sensitive information, while its leaked source code helped fuel years of adaptation by different threat actors.
Researchers said Gozi’s long lifespan was driven by continuous redevelopment, modular capabilities, and reuse across financially motivated campaigns. Its evolution into numerous strains allowed operators to tailor infections, evade detection, and maintain the malware’s relevance as one of the most enduring credential-theft platforms in the cybercrime ecosystem.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Check Point Research published a report detailing the history, variants, and development of the Gozi malware family. The reference indicates a retrospective analysis rather than a newly disclosed incident or campaign event.
G Data released an IOC-focused analysis covering multiple malware delivery chains that ended in the Gozi/URSNIF banking trojan. The report documented password-protected Word/VBS and JavaScript/downloader infection paths and published SHA-256 hashes for packed, unpacked, and DLL payload stages.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Colombian authorities arrested Romanian national **Mihai Ionut Paunescu**, also known as **"Virus,"** in Bogotá on U.S. charges tied to the **Gozi** banking trojan. Prosecutors allege Paunescu ran the bulletproof hosting service `PowerHost[.]ro` and helped protect and scale Gozi infrastructure after joining the operation around the release of **Gozi 2.0**. U.S. officials said the botnet infected more than **one million computers** between 2007 and 2013, stole online banking credentials, and enabled the theft of tens of millions of dollars from victims in the United States and Europe; authorities said they would pursue extradition from Colombia after earlier efforts in Romania failed. The arrest adds to a case that previously saw Gozi creator **Nikita Kuzmin** sentenced in the United States after admitting to computer intrusion and fraud offenses, while investigators also tied **Deniss Calovskis** to web injects used against banks. Court filings said Kuzmin marketed Gozi through an early malware-as-a-service scheme known as **"76 Service,"** renting the malware to other criminals. Security researchers have since linked Gozi’s leaked codebase to later malware families, including the advanced **RM3 / Gozi-ISFB** strain, which targeted more than 130 financial institutions across Oceania and Europe and expanded beyond credential theft into browser interception, hidden VNC, SOCKS proxying, remote shell access, and ransomware-enabling post-compromise activity.
Aug 15, 2026
The **Gozi/Ursnif/ISFB** banking trojan remained an active cybercrime threat across Europe and Japan, spreading mainly through targeted malspam and phishing emails carrying weaponized Word, XLS, ZIP, JavaScript, HTA, and macro-enabled attachments. Multiple campaigns used staged infection chains involving VBA macros, PowerShell, `rundll32`, HTA downloaders, and side-loaded DLLs, with distribution tied in some cases to the **Dark Cloud** botnet and other spam infrastructure. Researchers also observed related delivery through Shiotob downloaders and compromised web servers, with operators rotating domains, IPs, and lure content to reduce detection while targeting both retail and corporate banking users.
Aug 15, 2026
Researchers reported that **Valak** is a modular, enterprise-focused malware family spread through **reply-chain email hijacking** and malicious attachments or links, often using **password-protected ZIP files** to evade inspection. Campaigns targeted organizations across sectors including manufacturing, transportation, finance, insurance, health care, and energy, with infection chains commonly relying on Microsoft Word macros or JavaScript droppers that launched payloads through Windows LOLBins such as `regsvr32.exe` and `wscript` to load DLLs in memory and reduce detection. Multiple reports tied Valak to the broader **Gozi/Ursnif** ecosystem through overlapping infrastructure, delivery patterns, and follow-on activity. Analysts said Valak used compromised websites and PHP proxy scripts to fetch staged payloads and track spam delivery, while specialized plugins such as **EXCHGRABBER** and **CLIENTGRABBER** stole Exchange, Office, and email credentials from Credential Manager, autodiscover data, and the Windows registry. Related Gozi/Ursnif campaigns used hijacked email threads, Google Drive links, and password-protected archives before deploying additional tools including **Cobalt Strike**, **TVRat/TeamViewer**, and VNC-based modules, reinforcing the connection between credential theft, thread hijacking, and multi-stage enterprise intrusion activity.
Aug 15, 2026