Gozi

Gozi is a notorious malware that has been linked to numerous cyber attacks. It's typically delivered through sophisticated malvertising techniques, often used in conjunction with other initial access malware such as Pikabot botnet agent and IcedID information stealer. When an individual accesses a compromised website, a malicious MSIX installer is downloaded, which may carry additional payloads including Gozi. This malware, first detected in 2023, has been associated with various campaigns targeting organizations primarily in Western Europe and Japan, known for distributing the Ursnif (aka Gozi) banking Trojan. The threat group behind Gozi has utilized a variety of malware tools over the years, but it gained notoriety for its use of the Ursnif banking Trojan and a sophisticated second-stage downloader dubbed WikiLoader. WailingCrab, also referred to as WikiLoader, was first observed in December 2022 and has since been extensively used in email campaigns, often against Italian targets, to deliver the Gozi backdoor. This group has shown a propensity for evolving its tactics, as demonstrated by their abuse of CVE-2023-36025 in a campaign involving Remcos, a remote access Trojan. Gozi's capabilities extend beyond simple infection. In one instance, a PowerShell script delivered additional executables from a remote website, including an AES-encrypted Gozi banking trojan and the information stealer known as Vidar Stealer, which used Telegram for command and control (C2) information. The threat posed by Gozi and its associated malware families is significant, given their ability to exploit vulnerabilities, steal sensitive data, and disrupt operations across diverse geographies and sectors.