We see you, Gozi
Excerpt
The ISFB Trojan also known as Gozi ISFB first appeared in 2014. It is based on Gozi, which was released in 2006 and developed by Russian threat actors. Gozi was designed to collect network traffic and steal credentials from browsers and email clients. It has screen grabbing and keylogging functionalities.
The ISFB banking Trojan is a modified version of Gozi. The malware was identified in 2014 and it is also known as Gozi2 and Ursnif. It collects credentials and is mainly used for attacks on the client side of online banking (ATS attacks) and fraud. Given that the source code for Gozi ISFB is available online, there are now various forks based on ISFB such as GozNym or Dreambot.
New Gozi TTPs
Group-IB has been tracking the Gozi b…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Group-IB on blog.group-ib.com.
More from Group-IB28
- Stray Cat, Open Doors: How k0t Wanders Through the Network EdgeGroup-IB · Published 21 Oct
- BlogGroup-IB · Published 15 Dec 2022
- Anatomy of BraZetsu: How Cybercriminals Fuel the Underground EcosystemGroup-IB · Published 31 Aug
- JadeProx: Tracing a China-nexus Operation Through an OPSEC MistakeGroup-IB · Published 23 Jul
On the same topics
- Lorem Ipsum Revisited: ClickFix Pivot & Rapid BrigantineBlueVoyant · Added 25 Oct
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Showboat Malware: Emerging Threats Targeting Telecom ProvidersLumen Black Lotus Labs · Added 25 Oct
- International law enforcement initiate hunt on malware group SocGholishDutch National Police · Published 18 Jun
