We’re all familiar with Zeus, the king of financial malware. Infamous for targeting banks, credit unions and financial institutions, Zeus malware silently steals password and account information from customers of these institutions and uses their credentials to execute fraudulent money transfers.

A lesser known fact is that Zeus now also targets and attacks companies. Once Zeus is installed on a victim’s machine, it fetches a configuration file from one of its command and control servers. The file instructs Zeus on which websites and applications to target, which information to steal and how to steal it. This information is encrypted and is usually hard to capture. As part of our ongoing research, we capture and decrypt Zeus configurations to study them. Some of the Zeus 2.0 configurations we recently decrypted include the following code:


In English, this string tells Zeus the following: The “@” means “capture a screenshot of the text within the mouse’s vicinity when the left button is clicked.” The */citrix/* further specifies that this screenshot should be captured when the text “/citrix/” appears in the browser address bar. This code instructs Zeus to take a screenshot every time the left button is clicked while the browser’s URL includes the term “/citrix/.”

Here, Zeus is trying to capture login credentials from users of the Citrix Access Gateway, a popular SSL VPN solution used by businesses to provide secure remote access to applications and data inside their protected network. Criminals always seek the path of least resistance. In the case of enterprise networks, the least secure path is through mobile and remote employee computers, which are outside the control of most internal IT departments.

A Virtual Keyboard

Citrix is well aware and concerned about the threat of keyloggers and their ability to capture a user’s login information for the Citrix Access Gateway. In order to protect against this type of attack, Citrix developed a virtual keyboard solution. According to its website: “Keyloggers are becoming an increasing threat on the Internet, and pose a risk to security of corporate networks. They are applications that run silently on a PC or Internet kiosk and record the keystrokes entered by a user for later review. They pose a risk because they can capture usernames and passwords entered, which can then be reviewed and used in obtaining unauthorized access to the corporate network.”

The Citrix Access Gateway allows companies to customize the login page to include a virtual on-screen keyboard that replaces the physical keyboard. So instead of typing a password on the physical keyboard, mouse clicks are used to press keys drawn on the screen. This approach prevents keyloggers from capturing keystrokes, since there are none to capture.

The Zeus configuration snippet shown above is specifically designed to defeat the virtual keyboard capability in the Citrix Access Gateway. By capturing screenshots within the vicinity of the pointer during mouse clicks, Zeus is able to read the user’s password, which will clearly show up as the sequence of keys the mouse pointer was pointing at when the mouse was clicked.

Why a Configuration File Favors Corporate IT

This attack code clearly illustrates that Zeus is actively targeting enterprises, specifically remote access connections into secure networks. Fraudsters are no longer satisfied with simply going after bank accounts; they are also targeting intellectual property and sensitive information contained in company IT networks and applications. Users of remote access VPN systems like the Citrix Access Gateway (employees, contractors and partners) are purposely being targeted in a given configuration file because their computers are unmanaged and easily compromised with sophisticated malware like Zeus. As a result, corporate IT departments should be aware of this advanced threat and take steps to protect their unmanaged computers and remote sessions. These include limiting VPN access to specific applications and users, maintaining up-to-date malware protection on remote devices, using a secure browsing service to protect VPN connections and educating users on computer hygiene and secure browsing best practices.

2014 Ponemon Study: The Economic Impact of Advanced Persistent Threats (APTs)

More from Banking & Finance

Kronos Malware Reemerges with Increased Functionality

The Evolution of Kronos Malware The Kronos malware is believed to have originated from the leaked source code of the Zeus malware, which was sold on the Russian underground in 2011. Kronos continued to evolve and a new variant of Kronos emerged in 2014 and was reportedly sold on the darknet for approximately $7,000. Kronos is typically used to download other malware and has historically been used by threat actors to deliver different types of malware to victims. After remaining…

Why Cybersecurity Risk Assessment Matters in the Banking Industry

When customers put money in a bank, they need to trust it will stay there. Because of the high stakes involved for the customer, such as financial loss, and how long it takes to resolve fraud and potential identity theft, customers are sensitive to the security of the bank as well as fraud prevention measures. Banks that experience high volumes of fraud are likely to lose customers and revenue. The key is to protect customers and their accounts before problems…

Cost of a Data Breach: Banking and Finance

The importance of cybersecurity has touched almost every industry. Beyond that, robust cybersecurity is table stakes for several sectors, particularly health care and the banking and finance industry. Not only is financial data at risk, but so is customer trust. In banking and finance, trust means everything. Yet, consumers are hesitant to share their confidential data. A recent McKinsey survey revealed that no industry achieved a trust rating of 50% for data protection. Here’s the most sobering stat: 87% of…

What Do Financial Institutions Need to Know About the SEC’s Proposed Cybersecurity Rules?

On March 9, the U.S. Securities and Exchange Commission (SEC) announced a new set of proposed rules for cybersecurity risk management, strategy and incident disclosure for public companies. One intent of the rule changes is to provide “consistent, comparable and decision-useful” information to investors. Not yet adopted, these new rules – published in the Federal Register on March 23 – could change reporting requirements. Take a look at some of the big-ticket items and what your organization needs to know.…