What Is Zeus Trojan?

The Zeus Trojan, one of the oldest malware programs, was originally created to pilfer banking details from targeted victims. Although the original creator sold the Zeus code to a competitor, numerous variations have been released over the years. In fact, new versions of Zeus are still being released today. What began as a banking trojan has evolved into a comprehensive malware package that includes keyloggers, browser injection scripts, ransomware, and an advanced peer-to-peer communication network.

History of the Zeus Trojan

Zeus was initially identified in 2007, yet its origins remain murky. According to some accounts, a consortium of hackers from Eastern Europe might have created it, with Evgeniy Bogachev, alias Slavic, purportedly being the mastermind. Allegedly, Slavic retired in October 2010 and purportedly sold the Zeus code to SpyEye, a competing malware. However, this assertion is contentious, with conflicting sources suggesting that Slavic never relinquished the Zeus code and still retains the original botnet’s master key.

In May 2011, the Zeus source code was leaked, leading to the emergence of various iterations by different hacking groups. Among these, GameOver Zeus gained prominence, integrating the core Zeus functionalities alongside enhancements like peer-to-peer communication, Domain Generation Algorithms (DGA), encryption, and proxy servers to circumvent detection and disruption.

GameOver Zeus is also capable of distributing ransomware, which encrypts users’ files and demands payment for decryption. This ransomware operates independently, affecting users irrespective of whether GameOver Zeus is actively pilfering banking data. Initially, researchers managed to impede GameOver Zeus’s operations, but the authors swiftly adapted the code to circumvent these measures.

How Zbot Works

Zbot typically begins its operation through a phishing email containing a malicious link or attachment, enticing targeted users to download the malware upon execution. The initial step involves deploying the malware onto the local system to establish communication with the Zbot central command-and-control server. As a result, the local machine becomes part of the Zeus Trojan botnet, granting the botnet owner control over the device and access to its data.

The original Zeus Trojan incorporates a keylogger, a malicious application designed to capture keystrokes from the device’s keyboard. Whenever the targeted user inputs a URL, username, or password into a browser, the keylogger records this data and discreetly transmits it to the command-and-control center, unbeknownst to the user unless they detect the malware’s presence.

Over time, Zeus authors introduced a “web inject” component, embedding malevolent JavaScript code into banking pages to deceive users into disclosing sensitive information. These web inject components have the capability to bypass multi-factor authentication and directly pilfer data from the user’s account.

In the case of GameOver Zeus installation, the malware supplements the bank account-stealing component with ransomware. This ransomware operates similarly to other ransomware strains by scanning the local machine and shared drives for vital files, encrypting them using a robust cipher, and notifying the user of the infection. Subsequently, the user receives a ransom note detailing the steps to remit payment in exchange for file decryption.

How Zeus Affects Computers

Zeus primarily functions as crimeware, focused on pilfering targeted users’ banking information. While the webinject component handles much of the task of stealing this data, Zeus stands out due to its botnet and peer-to-peer communication capabilities. Additionally, Zeus incorporates proxy functionality to shield the command-and-control server from detection.

Initially, each peer-to-peer network operated with its own backbone overseen by its respective owner. Researchers suggest that the botnet served as a shield to safeguard critical infrastructure from detection, a strategy that proved effective for several years. Slavic collaborated with multiple cyber-criminals, granting each member of the group potential control over their individual botnets. However, Slavic retained exclusive access to all backend infrastructure, enabling him to manipulate the peer-to-peer network, upgrade software, retrieve data, or monitor activity at will. Thus, Slavic maintained complete control over Zeus despite the collective ownership of the network by cyber-criminals.

In instances where a targeted user’s computer is infected by GameOver Zeus with ransomware, the affected computer typically becomes inoperable. Ransomware’s efficacy in extorting businesses lies in its scanning capabilities, which extend to mapped drives, often encompassing network servers. Consequently, files across the network environment become irreversibly encrypted, rendering vulnerable computers, including critical application servers, unusable. Rebooting such servers or workstations may result in crashes or loss of accessibility. Often, the only recourse for administrators is to initiate disaster recovery procedures, entailing a clean OS installation and file recovery from backups. However, the time required for such recovery efforts translates to operational downtime for the corporation, leading to significant revenue losses.

How the Zeus Virus Infects Computers

An essential aspect of advanced malware is its ability to remain active within an environment without detection by administrators or users. Zeus is recognized as one of the most sophisticated malware programs in existence, having endured for over 15 years. This malware serves two primary objectives: stealing banking information and establishing communication restrictions among other computers within the botnet.

Zeus infiltrates the computer system, enabling continuous data theft, communication with the command-and-control server, and injection into banking web pages. Its primary intention is not to inflict harm on computers unless they are infected with GameOver Zeus, a variant featuring ransomware.

Once a targeted computer joins the botnet, it establishes communication with the command-and-control server. From there, an attacker supervises the server and can execute various commands on the infected computer, such as remote control access or retrieval of stolen data. Zeus primarily focuses on the theft of banking information, continuously monitoring web browser activity for bank account credentials and injecting malicious scripts into accessed web pages.

While some malware creators develop viruses to cause computer destruction, the creators of Zeus engineered it to evade detection and allow uninterrupted user activity. The longer the malware persists on a computer, the more data the attacker can extract from user actions. Moreover, each computer within the botnet can serve as a backup should another computer disconnect from the malware network.

Who Does Zeus Target?

Zeus doesn’t discriminate when it comes to targets. While malware aimed at businesses often seeks to disrupt operations or extort large sums of money, Zeus focuses on stealing banking credentials, enabling attackers to siphon funds from both individuals and businesses. Although attackers may customize their approach for specific businesses when controlling certain botnets, Zeus is versatile, capable of infecting servers, Android devices, and Windows workstations.

Expanding its reach beyond Windows-based trojans to include Android devices and targeting not just businesses and individuals but also governments, Zeus has broadened its scope of potential victims. With its command-and-control functionality, Zeus grants attackers access to local machine data, posing significant risks to governments, potentially exposing trade secrets and proprietary information if any of their workstations become compromised with Zeus malware.

The Zeus malware and botnet have already successfully stolen data from numerous notable government agencies and private enterprises. Among the victims are NASA, the US Department of Transportation (DOT), Bank of America, Amazon, Oracle, ABC, and Cisco, all falling prey to Zeus-enabled data breaches.

Zeus Trojan vs. GameOver Zeus: Understanding the Differences

Those with access to the original Zeus source code have already spawned numerous variants. Among them, GameOver Zeus stands out as a recent iteration, boasting enhanced sophistication compared to its precursor. Notably, GameOver Zeus incorporates a botnet component along with fortified encryption measures to safeguard communication data against law enforcement scrutiny.

As previously mentioned, GameOver Zeus inherits all the features of the original Zeus while introducing encrypted communication and the addition of CryptoLocker ransomware. While both variants inflict financial harm upon targets, the CryptoLocker element within GameOver Zeus arguably poses the most significant threat to organizations and individuals.

Upon installation by a targeted user, GameOver Zeus enlists the user’s computer into the standard Zeus botnet, after which the CryptoLocker ransomware initiates its operations. CryptoLocker scans for a range of file extensions and types, encrypting the identified data. To decrypt files, victims must obtain the private key by paying the ransom.

In 2014, researchers intercepted the private key for GameOver Zeus, enabling CryptoLocker victims to decrypt their files. In response, developers swiftly modified the code to circumvent researchers’ efforts, albeit temporarily rendering GameOver Zeus vulnerable to remediation.

How to Protect Yourself

Individuals and organizations can implement various strategies to prevent Zeus from infiltrating their systems. Educating employees on identifying phishing emails is paramount; this can be achieved through comprehensive security awareness training. Since most Zeus infections start with phishing emails containing malicious scripts or download links, raising awareness among staff members is crucial.

Keeping anti-malware and antivirus software updated is essential to detect and block the latest Zeus attacks effectively. While antivirus software isn’t foolproof, regular updates ensure it can recognize and neutralize new variants.

Given Zeus’s ability to steal passwords stored in browsers and password managers, it’s advisable not to store passwords on local machines. If a password manager is used, avoid storing the private key required for access.

Furthermore, individuals should avoid downloading pirated software, as it often harbors hidden malware. Obtaining software from legitimate sources and using licensed versions minimizes the risk of malware infiltration.

How to Remove Zeus

The exclusive means to eliminate Zeus from a computer entails utilizing antivirus software. Although it’s not feasible to decrypt files encrypted by CryptoLocker, employing a robust antivirus program can effectively eradicate both Zeus and its associated botnet.

The essential steps for removing Zeus are outlined below:

1. Download and install your preferred antivirus software.
2. Restart your Windows computer in Safe Mode without network support to prevent Zeus from establishing connections with its botnet.
3. Initiate a comprehensive scan of your computer using the antivirus software.
4. Follow the prompts provided by your antivirus program to eliminate any detected malware from your system.

Conclusion

Zeus Trojan, evolving since 2007, remains a significant cybersecurity threat. Through proactive measures like security training and antivirus use, individuals and organizations can mitigate its impact. Vigilance is key in combating Zeus and similar malware.