Loading story…
Researchers identified Trojan-Banker.Win32.Chthonic as a new ZeuS-family banking Trojan that evolved from the leaked ZeuS codebase and appears to borrow from ZeusVM, Andromeda, and KINS. The malware was observed targeting more than 150 banks and 20 payment systems across 15 countries, with notable focus on institutions in the UK, Spain, the US, Russia, Japan, and Italy. Initial infections were linked to malicious email campaigns carrying crafted RTF files exploiting CVE-2014-1761 in Microsoft Office, as well as delivery through the Andromeda botnet.
Chthonic uses a modular architecture that extends beyond traditional banking fraud, combining web injections, form grabbing, keylogging, and password theft with VNC-based remote access, SOCKS proxy functionality, and even webcam recording. Its operators also employed layered obfuscation and custom loading methods, including RC4, AES, a virtual-machine-based configuration decryptor, and ZeuS-style non-PE modules mapped directly into memory, underscoring how the ZeuS lineage had matured into a flexible and stealthy criminal malware framework.
See the actors and campaigns active against you right now.
3 events from the most recent confirmed update back to the earliest known activity.
Kaspersky Lab identified Trojan-Banker.Win32.Chthonic, a banking Trojan described as a new evolution of the ZeuS family. The malware was discovered in the fall of 2014 and was found targeting online banking and payment systems.
Kaspersky's analysis found Chthonic targeting more than 150 banks and 20 payment systems across 15 countries, especially in the UK, Spain, the US, Russia, Japan, and Italy. The malware used a modular architecture with capabilities including web injection, form grabbing, password theft, keylogging, VNC access, SOCKS proxying, and webcam recording.
Observed infections used malicious emails with a crafted RTF exploiting CVE-2014-1761 in Microsoft Office, as well as delivery through the Andromeda bot. Successful exploitation downloaded a Chthonic downloader, which then injected code into msiexec.exe.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 20 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **ZeuS** banking Trojan emerged as a dominant crimeware kit used to steal online banking credentials, browser-submitted form data, cookies, certificates, and files, while also enabling attackers to modify web pages, redirect victims, and execute arbitrary programs on infected systems. Reports describe ZeuS as a commercially sold toolkit priced around **$3,000–$4,000**, with add-on modules for capabilities such as backconnect access, VNC control, Firefox form grabbing, and Windows Vista/7 support. Its architecture evolved across the `1.2.x`, `1.3.x`, and `1.4.x` branches to add stronger encryption, web injects, API hooking, anti-analysis protections, random file names and mutexes, and RC4-encrypted communications with command-and-control servers, while commonly injecting into processes such as `winlogon.exe` or `explorer.exe`. The malware’s ecosystem also expanded into both competition and mobile fraud. SpyEye was marketed as a cheaper rival and introduced **"ZeusKiller"** to remove or hijack existing ZeuS infections, while ZeuS itself adopted hardware-based licensing and continued adding premium criminal features. A related mobile component, **ZeuS-in-the-Mobile (ZitMo)**, was used to intercept SMS-based transaction authentication numbers by tricking banking victims into installing fake mobile security software, allowing attackers to complete fraudulent transfers after harvesting credentials on the PC. More recent reporting also tied the **KINS** Zeus variant to a malvertising campaign targeting European transit users, where victims were redirected to malware disguised as a PDF, protections such as Windows Defender were weakened via registry changes, and the payload used characteristic POST traffic and inbound connectivity to maintain control.
Aug 15, 2026
**ICE IX** emerged as an early banking Trojan built from the leaked **ZeuS** source code, giving cybercriminals a ready-made platform for credential theft and botnet operations. Sold on underground forums for about **$1,800**, the malware used **HTTP**-based command-and-control through a web panel and targeted online banking sessions with browser hooking, web injects, and form grabbing. Reporting tied the threat to theft involving **Amazon EC2** data, while researchers warned that the ZeuS source leak would accelerate the creation of similar follow-on crimeware families. Technical analysis showed ICE IX largely reused ZeuS tradecraft rather than introducing major new capabilities. The malware employed **RC4**-protected communications, fake Google traffic to blend in, Windows registry persistence, and a self-deleting dropper, while also stealing credentials from browsers, FTP and mail clients, cookies, Flash `.sol` files, and certificates. Researchers found support for backconnect access, **SOCKS** proxying, **VNC**, screenshot capture, and certificate deletion, but concluded that many of the product's advertised enhancements—such as tracker resistance and stronger evasion—were overstated, amounting mostly to minor code changes and repackaging of existing ZeuS functionality.
Aug 15, 2026
Researchers tied the **DELoader** malware family targeting German-speaking users to the later **Zloader**/**Zeus Sphinx** banking trojan, showing how an early loader evolved into a broader modular crimeware platform. Fortinet found DELoader creating a suspended `explorer.exe`, decrypting and injecting an embedded DLL, then downloading and validating an additional PE payload from command-and-control infrastructure. Exposed victim logs and code strings indicated infections concentrated in **Germany and Austria**, while domain registration details overlapped with infrastructure previously associated with **Zeus** and **Marcher** banking malware campaigns. Later reverse engineering showed Zloader using layered obfuscation, process injection, encrypted configuration data, and a **domain generation algorithm (DGA)** that produces 20-character `.com` fallback domains from date-based seeds and embedded RC4 keys. Avast described **Zloader 2 / Silent Night** as a modular banking malware platform capable of credential theft, web injects, keylogging, screenshot capture, VNC-style remote control, cryptocurrency wallet theft, and delivery of additional payloads, with distribution through spam, fake installers, and malicious websites. Investigators also linked Zloader operations to other malware ecosystems including **Raccoon Stealer** and **Ursnif**, and noted that its botnet infrastructure became the subject of a joint **Microsoft-led takedown** effort.
Aug 15, 2026