Zeus / Zbot Banking Trojan Technical Intelligence Dossier

Executive Summary & Threat Architecture

Zbot (universally known as Zeus, and documented under variants such as Zeus Panda, GameOver Zeus, and Wsnpoem) is arguably the most influential banking trojan and crimeware toolkit in cybersecurity history. Originally authored in 2006 by Russian threat actor 'Slavik' (Evgeniy Mikhailovich Bogachev, operative head of the 'Business Club' syndicate), Zeus established the architectural paradigm for modern credential theft, automated banking diversion, and decentralized botnet operations. The malware executes via stealthy injection into critical Windows processes (winlogon.exe, svchost.exe, explorer.exe) and hooks low-level WinINet and NSS socket libraries. Through this Man-in-the-Browser (MitB, T1185) mechanism, Zeus captures plaintext banking credentials, account numbers, and personal identifiers before transmission and browser-side TLS/SSL encryption. Zeus pioneered dynamic HTML web-injections and Automated Transfer Systems (ATS), which secretly modify account balances in the victim's browser while surreptitiously redirecting wire funds to money-mule bank accounts in real time. In 2011, the complete Zeus source code was leaked online, sparking a massive proliferation of derivative banking malware, including Citadel, Ramnit, SpyEye, KINS, and Panda Banker. Following the leak, Bogachev developed 'GameOver Zeus' (GOZ), replacing the centralized HTTP C2 architecture with an advanced, resilient peer-to-peer (P2P) network with cryptographic domain generation algorithms (DGAs). GameOver Zeus infected over one million endpoints worldwide and served as the primary distribution channel for CryptoLocker, the first major global crypto-ransomware epidemic. In June 2014, an international law enforcement coalition dismantled the GOZ infrastructure under Operation Tovar, leading to CISA Alert AA14-150A and the FBI placing Bogachev on its Cyber Most Wanted list.

Observed Threat Aliases: Zeus, Zbot, GameOver Zeus, Zeus Panda, Wsnpoem, Trojan-Spy.Win32.Zbot, Win32/Zbot, Trojan:Win32/Zbot

Ancestry & Lineage Tracking

Derived From / Upstream Ancestry: prt

Documented Downstream Variants: gameover_zeus, zeus_panda, citadel, ramnit, spyeye, kins, floki_bot

Weaponized Vulnerabilities & Exploitation Topology

Documented common vulnerabilities and exposures (CVEs) weaponized by Zeus / Zbot Banking Trojan operators for initial execution, sandbox evasion, or SYSTEM-level kernel privilege escalation:

→ Explore all 77 exploited vulnerabilities on the SystemHelpDesk CVE Threat Matrix Hub.

MITRE ATT&CK® Tactical Tradecraft

Tactics, techniques, and procedures (TTPs) systematically mapped across real-world intrusion kill-chains:

→ Inspect the complete 226-technique matrix on the MITRE ATT&CK Defense Hub.

Indicators of Compromise (IOCs) & Forensic Artifacts

Curated indicators for retrospective threat hunting across SIEM and EDR platforms:

Initial Delivery Vectors

• Drive-by downloads from compromised websites via browser exploit kits (Blackhole, Phoenix, Nuclear)
• Malspam phishing emails with weaponized PDF and Word attachments exploiting CVE-2010-0805 and CVE-2013-3893
• Upatre downloader and peer-to-peer distribution networks

Host Persistence & Execution Hooks

• Registry Run key under HKLM\Software\Microsoft\Windows\CurrentVersion\Run
• Userinit registry key modification: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
• Process injection into winlogon.exe, svchost.exe, and explorer.exe hooking WinINet.dll and nss3.dll

Reference File Hashes (SHA-256)

• d6c3821034f5d2b7812f86d6342898ad9de7e3b12365a6f272a27546857ea568
• f66d4825925a1769123868ef6093fb18227096d29d4948a2872323a7bb146312
• 0c7493a77a9be3b33346ff1758c0c97793d544078aa868f76dcf42f02e5bfe75