Gameover Zeus

GameOver Zeus is a variant of the ZeuS malware, used by malicious actors to steal banking credentials and distribute other types of malware, including ransomware such as Cryptolocker. It operated as a banking Trojan, infecting systems and stealing sensitive information. The botnet was closely associated with Evgeniy Bogachev, a Russian cybercriminal linked to various malware schemes, including Zeus, Jabber Zeus, and GameOver Zeus. Notably, there were indirect affiliations suggesting that the Russian government might have utilized the GameOver Zeus botnet for espionage or Distributed Denial of Service (DDoS) attacks. In 2014, the FBI led an international effort to disrupt the GameOver Zeus botnet, which had infected between 500,000 and a million computers worldwide. This operation, known as Operation Tovar, targeted not only the botnet but also the Cryptolocker ransomware it distributed. Despite its disruption, GameOver Zeus left a significant impact on the cybersecurity landscape, prompting the emergence of successor threats like Dridex, a derivative of the Cridex banking worm, which adopted a similar affiliate model. Post-disruption of GameOver Zeus in 2014, threat actors created botnets such as Dridex to fill the void. Unlike GameOver Zeus, Dridex never matched the sophistication, size, and success of its predecessor. However, it evolved into a monetized platform for other threat actors to run malicious campaigns on a pay-per-install model, facilitating theft of sensitive data and ransom extortion. Despite having a hybrid Peer-to-Peer (P2P) architecture, these botnets significantly limited their ability to self-organize and maintain themselves without outside intervention, unlike other P2P botnets such as Kelihos and GameOver Zeus.