Zeus Trojan: Form-Grabbing Bank Theft, Money Mules and GameOver Zeus

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

Zeus surfaced in July 2007 in an attack on the U.S. Department of Transportation. The Windows Trojan spread through phishing emails and drive-by downloads and stole banking credentials two ways: keystroke logging, and form grabbing, which hooks into the browser and copies login data just before it is encrypted. By March 2009 infections were called widespread, and in June 2009 researchers found more than 74,000 compromised FTP accounts at organizations including NASA, Bank of America, Amazon, Cisco, Oracle, ABC, Monster.com and BusinessWeek. With an estimated 3.6 million infected PCs in the U.S., it became the largest botnet on the internet, and its polymorphic engine re-encrypted its code with each infection to slip past signature-based antivirus, a limit Symantec openly acknowledged.

Zeus operators later added fake tech support scares, opening real Windows diagnostic logs to convince victims to pay by card. Turning stolen bank access into cash required money mules, often recruited from overseas with fake work-from-home offers, who opened U.S. accounts under false names and moved funds for an 8 to 10 percent cut. In October 2010 the FBI revealed a crackdown that arrested more than 100 people in the U.S., the U.K. and Ukraine over a ring that stole $70 million from business and municipal accounts. Around then, Zeus's creator claimed to be retiring and passing the code to the author of rival SpyEye, a move security experts called a ruse. Evgeniy Bogachev was indicted in 2014 for GameOver Zeus, which the FBI tied to more than $100 million in losses.

• GameOver Zeus used a peer-to-peer design with no central command server, so shutting down nodes did not kill the botnet.
• Hamza Bendelladj, known as BX1, was arrested at a Thai airport in 2013 and deported to Atlanta, accused of running SpyEye botnets and selling custom Zeus versions.
• Swiss police arrested Ukrainian Vyacheslav Penchukov, known as Tank, in Geneva in October 2022 over the Jabber Zeus crew's attacks on small and midsize businesses.
• Penchukov was extradited in 2023, pleaded guilty in 2024 and in July 2024 received nine years in federal prison and a $73 million restitution order.
• Zeus sellers marketed customizable kits with technical support, an underground software-as-a-service model.