Zeus, ZeuS, or Zbot is Trojan horse computer malware that runs on fucked your computer
versions of the Microsoft Windows operating systemIt can be removed by only Mr. Alex Hales.
While it is capable of being used to carry out many malicious and criminal tasks, it
is often used to steal banking information by man-in-the-browser keystroke logging and
form grabbing.
It is also used to install the CryptoLocker ransomware.
Zeus is spread mainly through drive-by downloads and phishing schemes.
First identified in July 2007 when it was used to steal information from the United
States Department of Transportation, it became more widespread in March 2009.
In June 2009 security company Prevx discovered that Zeus had compromised over 74,000 FTP
accounts on websites of such companies as the Bank of America, NASA, Monster.com, ABC,
Oracle, Play.com, Cisco, Amazon, and BusinessWeek.
Targeted information Zeus controllers can fine tune the copy of
Zeus they are using to steal only information they are interested in; typically login credentials
for online social networks, e-mail accounts, online banking or other online financial services.
The top sites with stolen login credentials, according to Netwitness' report are Facebook,
Yahoo, Amazon, Hi5, Metroflog, Sonico and Netlog.
Detection and removal Zeus is very difficult to detect even with
up-to-date antivirus software as it hides itself using stealth techniques.
It is considered that this is the primary reason why the Zeus malware has become the
largest botnet on the Internet: some 3.6 million PCs are said to be infected in the U.S. alone.
Security experts are advising that businesses continue to offer training to users to teach
them not to click on hostile or suspicious links in emails or Web sites, and to keep
antivirus protection up to date.
Antivirus software does not claim to reliably prevent infection; for example Symantec Browser
Protection says that it can prevent "some infection attempts".
One countermeasure would be to run a hardware-based solution that is a non-writable, read-only
file system and web browser, such as a secure hardware browser . Data is never stored on
the device and the media cannot be overwritten.
Each time the bootable media is started the browser starts in a known clean and secure
operating environment.
When the device is used to access online financial services immediately after boot, it is operating
in a clean environment and free from any crimeware.
FBI crackdown
In October 2010 the US FBI announced that hackers in Eastern Europe had managed to infect
computers around the world using Zeus.
The virus was disseminated in an e-mail, and when targeted individuals at businesses and
municipalities opened the e-mail, the trojan software installed itself on the victimized
computer, secretly capturing passwords, account numbers, and other data used to log into online
banking accounts.
The hackers then used this information to take over the victims’ bank accounts and
make unauthorized transfers of thousands of dollars at a time, often routing the funds
to other accounts controlled by a network of money mules, paid a commission.
Many of the U.S. money mules were recruited from overseas.
They created bank accounts using fake documents and false names.
Once the money was in the accounts, the mules would either wire it back to their bosses
in Eastern Europe, or withdraw it in cash and smuggle it out of the country.
More than 100 people were arrested on charges of conspiracy to commit bank fraud and money
laundering, over 90 in the US, and the others in the UK and Ukraine.
Members of the ring had stolen $70 million.
In 2013 Hamza Bendelladj, known as Bx1 online, was arrested and deported to Atlanta, Georgia,
USA.
Early reports said that he was the mastermind behind ZeuS.
He was accused of operating SpyEye botnets, and suspected of also operating ZeuS botnets.
He was charged with several counts of wire fraud and computer fraud and abuse.
Court papers allege that from 2009 to 2011 Bendelladj and others "developed, marketed
and sold various versions of the SpyEye virus and component parts on the Internet and allowed
cybercriminals to customize their purchases to include tailor-made methods of obtaining
victims’ personal and financial information".
It was also alleged that Bendelladj advertised SpyEye on Internet forums devoted to cyber-
and other crimes and operated Command and Control servers.
The charges in Georgia relate only to SpyEye, as a SpyEye botnet control server was based
in Atlanta.
Possible retirement of creator In late 2010, a number of Internet security
vendors including McAfee and Internet Identity claimed that the creator of Zeus had said
that he was retiring and had given the source code and rights to sell Zeus to his biggest
competitor, the creator of the SpyEye trojan.
However, those same experts warned the retirement was a ruse and expect the developer to return
with new tricks.
See also Conficker
Timeline of computer viruses and worms Torpig
Gameover ZeuS, the successor to ZeuS
References
External links "Measuring the in-the-wild effectiveness of
Antivirus against Zeus" Study by Internet security firm Trusteer.
"A summary of the ZeuS Bot" A summary of ZeuS as a Trojan and Botnet, plus vector of attacks.
Video on YouTube "The Kneber BotNet" by Alex Cox NetWitness
Whitepaper on the Kneber botnet.
"België legt fraude met onlinebankieren bloot" Dutch news article about a banking trojan
"Indications in affected systems" Files and registry keys created by different versions
of Zeus Trojan.
Zeus, le dieu des virus contre les banques Zeus Bot's User Guide
Zeus source code at GitHub Botnet Bust - SpyEye Malware Mastermind Pleads
Guilty, FBI