{
  "family": "chthonic",
  "sample_count": 14,
  "category": "trojan",
  "description": "Trojan:Win32/Chthonic is an advanced, highly sophisticated Banking Trojan and a direct evolutionary offshoot of the infamous ZeuS (Zbot) malware source code. Discovered around 2014, Chthonic is designed to stealthily hijack online banking sessions, bypass two-factor authentication, and facilitate massive financial fraud utilizing complex web injection techniques and modular architecture.<br><br><b>Understanding Chthonic</b><br>To an infected user, Chthonic is entirely invisible. When the user logs into their online bank, everything looks normal. For a threat intelligence analyst, Chthonic represents a top-tier financial threat. It utilizes a modular framework, downloading specific plugins (like a keylogger, a VNC module for remote control, or a video recorder) based on the attacker's needs. Its primary weapon is 'Man-in-the-Browser' (MitB) capabilities, allowing it to modify banking web pages on the fly to trick users into handing over authentication tokens.<br><br><b>Execution and Web Injection Mechanics</b><br>Chthonic was typically distributed via the Andromeda botnet or malicious document attachments (`T1566.001`). Upon execution, it utilizes aggressive process injection (`T1055`)—often injecting into `msiexec.exe` or the browser process itself—to establish a foothold and hide from security software. Once a user navigates to a targeted banking URL, Chthonic intercepts the browser's web traffic (`T1185`). Using its web inject configuration file (downloaded from the C2), it seamlessly inserts fake HTML forms (e.g., 'Please verify your ATM PIN') directly into the legitimate banking page (`T1056.002`). It captures the user's keystrokes, credentials, and answers to security questions, exfiltrating the data to the attacker's server to automate fraudulent wire transfers.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is severe financial loss, often bypassing modern security controls like SMS tokens. Incident responders will rarely see obvious signs of infection. EDR platforms must alert on process hollowing or suspicious memory injections targeting `explorer.exe` or web browser executables (Chrome, Firefox, IE). Memory forensics is required to extract the unencrypted Chthonic configuration file, which reveals the specific banks being targeted.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1105",
    "T1185",
    "T1055",
    "T1056.001",
    "T1056.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1185",
      "name": "Browser Session Hijacking (Man-in-the-Browser)",
      "tactic": "Collection"
    },
    {
      "id": "T1056.002",
      "name": "Input Capture: GUI Input Capture (Web Injects)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer (Downloading Plugins)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Credential Access"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network; an active Chthonic infection means the attacker is likely monitoring banking sessions in real-time.",
    "Assume all credentials typed on the machine (corporate passwords, banking logins) are compromised and enforce immediate enterprise-wide password resets.",
    "Capture a full forensic memory image (RAM dump) to extract the injected modules and the encrypted web inject configuration file.",
    "Do not trust web browsers on the infected machine; perform a complete bare-metal wipe and reinstall of the operating system."
  ],
  "what_to_avoid": [
    "Do not assume multi-factor authentication (MFA/SMS) will protect you; Chthonic uses web injects to socially engineer the user into typing the MFA code into a fake prompt.",
    "Avoid relying solely on file-based antivirus to 'clean' the infection, as the modular architecture and process hollowing techniques make complete remediation extremely difficult without a format."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}