GameOver Zeus: Three Things You Should Know

The Zeus banking Trojan is a popular topic in the security world these days. It’s not new, but it still garners attention as one of the most successful and prolific Trojans in use today.

Banking Trojans hide on infected machines and intercept activity related to the user’s finances—bank account logins, investment information, even purchases on sites like eBay. This differs from phishing. With phishing, an end user is infected with a banking Trojan like Zeus, but they are not directed to a fake website and made to believe they are logging in to an official website.

Instead, he or she is interacting with the real banking, investing, or retail website and is completing a legitimate transaction. However, while that activity takes place, keystrokes are being logged. Screenshots may even be taken and transmitted to the attackers C&C server. Usernames, passwords, security questions are all being monitored and recorded and transmitted to the attackers. All of these malicious actions occur silently. Once infected, there will be no sign that an Internet sessions is anything but private.

Since the 2010 leak of the Zeus source code, a host of Zeus variants has been unleashed on an unsuspecting public. Cybercriminals leaped at the opportunity to diversify both the traits and abilities of the Zeus Trojans, building their own variants. Some of those Zeus variants —such as Ice IX and Citadel—have garnered attention for their huge successes.

Perhaps the most successful Zeus variant to date, GameOver Zeus, was responsible for 38% of banking Trojan activity in 2013. In this post, we’ll explore three things that you need to know about GameOver Zeus.

#1: The difference between GameOver Zeus and other Zeus variants.

While other prominent Zeus variants – and their associated botnets – rely on centralized command and control infrastructure, GameOver uses a distributed peer-to-peer botnet. This means instructions can come from virtually any other infected machine. That is part of the reason for the success of the Trojan. Nailing down the all-important points of origin for these instructions is incredibly difficult, if not nearly impossible.

#2: GameOver Zeus is the most versatile Zeus Variant.

GameOver Zeus is the most versatile of the Zeus variants and enjoys the advantage of being distributed via email attachments and downloaders, or through URLs in emails that point to online exploit kits. Those same exploit kits are also used in drive-by attacks on the Web, and via malvertising that directs traffic to the sites. Regardless of the online medium, GameOver can utilize an attack vector to gain a foothold in your system.

Once a machine is infected, it can receive instructions to download even more malicious payloads: Other malware that can perform a much wider range of malicious actions. PhioshMe has observed the GameOver botnet distributing malware aimed at generating more malware-laden spam, stealing Bitcoin and other cryptocurrency wallets from an infected machine, as well as downloading CryptoLocker. CryptoLocker is ransomware that encrypts a wide range of files on the infected machine, rendering it unusable until a ransom payment is made. All photos, documents, databases, images, and other important files are locked with powerful, unbreakable encryption.

#3: Recent changes have made it more likely for Zeus to infect a machine on your network.

Last September, PhishMe saw GameOver’s distributors begin using the Upatre malware downloader—a downloader which served largely as a replacement for the more substantial Pony Loader that was largely abandoned following the fall of the Blackhole exploit kit.

Upatre capitalizes on leaving a smaller footprint and utilizes simple, yet effective encryption techniques to hide the GameOver infection process. This more sophisticated and nuanced approach makes less “noise” in infected systems and utilizes “throw-away” distribution resources.  This variation in the way GameOver is distributed makes it much more difficult for the average user to avoid becoming infected with the Zeus Trojan, by reducing the likelihood that he or she will notice anything out the ordinary is happening.

In just the past two months, the developers of GameOver Zeus have implemented additional functionality to make their malware more persistent and harder to detect. This includes the addition of rootkit functionality borrowed from the prominent Necurs rootkit to prevent removal of the malware. Steps are also taken to prevent any potential future botnet sinkhole attempts.

Cybercriminals are, and always have been, persistent, savvy, and dynamic. Their continued development of GameOver serves to underscore all three of those traits. However, this malware clearly shows that they are also successful.

How has GameOver Zeus affected your business? Tell us what else you think business leaders should know about GameOver Zeus in the comments section below.

Symantec to CISOs: Watch for the 'mega-breach'
Training Bad Habits Out of Users: End User Training

Leave a Reply