Zeus is a Trojan horse malware package that runs on versions of Microsoft Windows. It is often used to steal banking information by man-in-the-browser keystroke logging and form grabbing. Zeus is spread mainly through drive-by downloads and phishing schemes.
First identified in July 2007 when it was used to steal information from the United States Department of Transportation, it became more widespread in March 2009. In June 2009, security company Prevx discovered that Zeus had compromised over 74,000 FTP accounts on websites of companies including Bank of America, NASA, Monster.com, ABC, Oracle, Play.com, Cisco, Amazon, and BusinessWeek.
Zeus is very difficult to detect even with up-to-date antivirus and other security software, as it hides itself using stealth techniques. This difficulty in detection is considered a primary reason Zeus became the largest botnet on the Internet at the time; Damballa estimated that the malware infected 3.6 million PCs in the United States in 2009.
In October 2010, the U.S. FBI announced that hackers in Eastern Europe had managed to infect computers worldwide using Zeus. The virus was distributed in an email, and when targeted individuals at businesses and municipalities opened the email, the Trojan software installed itself on the victimized computer, secretly capturing passwords, account numbers, and other data used to log into online banking accounts. The hackers used this information to make unauthorized transfers, often routing funds through a network of money mules. More than 100 people were arrested on charges of conspiracy to commit bank fraud and money laundering, over 90 in the U.S. and others in the UK and Ukraine. Members of the ring had stolen $70 million.
In late 2010, a number of Internet security vendors including McAfee and Internet Identity reported that the creator of Zeus had stated he was retiring and had given the source code and rights to sell Zeus to his biggest competitor, the creator of the SpyEye Trojan. However, experts warned the retirement was a possible ruse and expected the developer to return with new tricks.
Zeus has spawned numerous variants, including Gameover ZeuS, which became a successor to the original Zeus. The malware's source code was eventually released publicly, leading to many derivative Trojans and botnets being built upon its architecture.
