{
  "family": "zeusvm",
  "sample_count": 1,
  "category": "trojan",
  "description": "<h3>Executive Summary</h3>\nZeusVM is a highly sophisticated variant of the infamous Zeus banking trojan. Emerging after the original Zeus source code was leaked, ZeusVM is notorious for its advanced evasion techniques—most notably the use of digital steganography to conceal its configuration files within seemingly benign image formats (like JPGs).\n\n<h3>Technical Characteristics and Infection Chain</h3>\nZeusVM is primarily distributed via malicious spam (malspam) campaigns containing exploit kits or macro-enabled Office documents. \n\nIts defining characteristic is its approach to command-and-control (C2) communication. To evade network intrusion detection systems (NIDS) and deep packet inspection, ZeusVM downloads its updated configuration files and web-inject scripts disguised as standard image files (e.g., a sunset or a logo). The malware extracts the hidden malicious data using a custom steganography algorithm. \n\nOnce active, ZeusVM employs \"man-in-the-browser\" (MitB) techniques. It hooks into browser APIs to intercept web traffic in real-time, allowing it to:\n<ul>\n<li><strong>Web Injection:</strong> Seamlessly inject fraudulent fields (e.g., asking for a PIN or social security number) into legitimate banking websites.</li>\n<li><strong>Form Grabbing:</strong> Capture authentication credentials immediately as the user types them, bypassing HTTPS encryption.</li>\n<li><strong>Transaction Manipulation:</strong> Alter the destination account and amount of wire transfers in the background, while displaying the original, correct transaction details to the victim.</li>\n</ul>\n\n<h3>Threat Impact</h3>\nZeusVM represents a critical threat to the financial sector and corporate accounting departments. A successful infection routinely leads to massive financial fraud, unauthorized wire transfers, and the complete compromise of corporate banking credentials.\n\n<h3>Detection and Eradication</h3>\n<ul>\n<li><strong>Behavioral Analytics:</strong> Deploy EDR solutions capable of detecting anomalous API hooking, particularly targeting `WinINet` or `NSS` (Network Security Services) libraries within browser processes.</li>\n<li><strong>Network Segmentation and Filtering:</strong> Implement strict egress filtering. Monitor for anomalous downloads of image files from unknown or newly registered domains, which may contain steganographic configuration data.</li>\n<li><strong>Multi-Factor Authentication (MFA):</strong> Enforce robust MFA. While ZeusVM can steal passwords, it struggles to bypass out-of-band authentication methods (like push notifications to a separate mobile device) required for wire transfers.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Trojan.ZeusVM",
    "Zbot.VM",
    "Win32/ZeusVM"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1056.004",
    "T1185",
    "T1027.003",
    "T1566.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T16:06:52Z",
  "type": "Banking Trojan",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}