Gozi

Malware updated 4 months ago (2024-05-04T17:21:31.642Z)

Download STIX

Preview STIX

Gozi is a notorious malware that has been linked to numerous cyber attacks. It's typically delivered through sophisticated malvertising techniques, often used in conjunction with other initial access malware such as Pikabot botnet agent and IcedID information stealer. When an individual accesses a compromised website, a malicious MSIX installer is downloaded, which may carry additional payloads including Gozi. This malware, first detected in 2023, has been associated with various campaigns targeting organizations primarily in Western Europe and Japan, known for distributing the Ursnif (aka Gozi) banking Trojan. The threat group behind Gozi has utilized a variety of malware tools over the years, but it gained notoriety for its use of the Ursnif banking Trojan and a sophisticated second-stage downloader dubbed WikiLoader. WailingCrab, also referred to as WikiLoader, was first observed in December 2022 and has since been extensively used in email campaigns, often against Italian targets, to deliver the Gozi backdoor. This group has shown a propensity for evolving its tactics, as demonstrated by their abuse of CVE-2023-36025 in a campaign involving Remcos, a remote access Trojan. Gozi's capabilities extend beyond simple infection. In one instance, a PowerShell script delivered additional executables from a remote website, including an AES-encrypted Gozi banking trojan and the information stealer known as Vidar Stealer, which used Telegram for command and control (C2) information. The threat posed by Gozi and its associated malware families is significant, given their ability to exploit vulnerabilities, steal sensitive data, and disrupt operations across diverse geographies and sectors.

Description last updated: 2024-05-04T16:38:00.751Z

What's your take? (Question 1 of 5)

Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.

Possible Aliases / Cluster overlaps

It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.

ID	Votes	Profile Description
Ursnif	6	Ursnif, also known as Gozi or ISFB, is a type of malware that poses significant threats to computer systems and user data. It's often distributed through suspicious downloads, emails, or websites, infiltrating systems without the user's knowledge. Once installed, Ursnif can steal personal informatio
IcedID	3	IcedID is a malicious software (malware) that has been linked to various cybercrime operations. The malware can infiltrate systems via suspicious downloads, emails, or websites and proceed to steal personal information, disrupt operations, or hold data for ransom. IcedID has been associated with oth
Pikabot	2	PikaBot is a malicious software (malware) known for providing initial access to infected computers, enabling ransomware deployments, remote takeovers, and data theft. It's part of an array of malware families such as IcedID, Qakbot, Gozi, DarkGate, AsyncRAT, JinxLoader, among others, which have been
Isfb	2	ISFB, also known as Gozi or Ursnif, is a form of malware that has been a significant part of the cyberthreat landscape for several years. This malicious software is designed to exploit and damage computer systems, often infiltrating through suspicious downloads, emails, or websites without the user'
Ta544	2	TA544 is a financially motivated, advanced persistent threat (APT) actor that has been tracked by cybersecurity firm Proofpoint and others since at least 2017. This malicious actor typically uses Ursnif malware to target organizations, predominantly in Italy and Japan. The Ursnif banking trojan, als
Wikiloader	2	WikiLoader is a sophisticated malware that has been used in notable campaigns identified by HP Wolf Security. It exploits open redirect vulnerabilities within websites to circumvent detection, a tactic known as 'Cat-Phishing'. The malware has been particularly active in Italy, where it's being used

Miscellaneous Associations

Other elements of context that could aid in the identification of relevance

Malware

Trojan

Exploit

Ransomware

Windows

Botnet

Analyst Notes & Discussion

Be the first to leave your mark here! Log in to share your views and vote.

Associated Malware

To see the evidence that has resulted in these malware associations, create a free account

ID	Type	Votes	Profile Description
Gozi Isfb	Unspecified	3	Gozi ISFB, also known as Ursnif and Dreambot, is a malicious software (malware) that has been actively developed and distributed worldwide. This malware is designed to exploit computer systems, primarily targeting the banking and financial sectors by stealing passwords and credentials from victims.
Zeus	Unspecified	2	Zeus is a notorious form of malware, or malicious software, designed to exploit and damage computer systems. It infiltrates devices often without the user's knowledge via suspicious downloads, emails, or websites. Once embedded within a system, Zeus can steal personal information, disrupt operations
BlackEnergy	Unspecified	2	BlackEnergy is a potent malware toolkit that has been utilized by criminal and Advanced Persistent Threat (APT) actors since 2007. Its destructive capabilities were notably demonstrated in Ukraine where it was used for cyber-espionage, compromising industrial control systems, and launching attacks a
WastedLocker	Unspecified	2	WastedLocker is a malicious software, or malware, developed in 2020 by the Evil Corp Group. It's a phone ransomware that targets both Windows and Android devices, capable of exploiting and damaging your computer or device without your knowledge. WastedLocker is a part of a lineage of malware that in
Dridex	Unspecified	2	Dridex is a well-known malware, specifically a banking Trojan, that has been utilized by cybercriminals to exploit and damage computer systems. The malware infiltrates systems through dubious downloads, emails, or websites, often unbeknownst to the user, and can steal personal information, disrupt o

Source Document References

Information about the Gozi Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more

Source Link	CreatedAt	Title
CERT-EU	6 months ago	Cybercrime on Main Street – Sophos News \| #cybercrime \| #infosec \| National Cyber Security Consulting
CERT-EU	6 months ago	Cybercrime on Main Street – Sophos News \| #cybercrime \| #computerhacker - Am I Hacker Proof
CERT-EU	8 months ago	Microsoft Disables App Installer After Feature is Abused for Malware
MITRE	9 months ago	DEV-0569 finds new ways to deliver Royal ransomware, various payloads \| Microsoft Security Blog
DARKReading	9 months ago	Exploit for Critical Windows Defender Bypass Goes Public
CERT-EU	9 months ago	Security Week In Review: November 24, 2023
CERT-EU	9 months ago	Alert: New WailingCrab Malware Loader Spreading via Shipping-Themed Emails
DARKReading	10 months ago	Proof of Concept Exploit Publicly Available for Critical Windows SmartScreen Flaw
DARKReading	10 months ago	Exploit for Critical Windows Defender Bypass Goes Public
SecurityIntelligence.com	10 months ago	ITG23 Crypters Highlight Cooperation Between Cybercriminal Groups
CERT-EU	a year ago	Storm-0324 Exploits MS Teams Chats to Facilitate Ransomware Attacks
Unit42	a year ago	RedLine Stealer: Answers to Unit Wireshark Quiz
CERT-EU	a year ago	Cost of a data breach 2023: Financial industry impacts
CERT-EU	a year ago	Remote access detection in 2023: Unmasking invisible fraud
Unit42	a year ago	Crossing the Line: Unit 42 Wireshark Quiz for RedLine Stealer
CERT-EU	a year ago	Gozi strikes again, targeting banks, cryptocurrency and more
CERT-EU	a year ago	How the US Government is Fighting Back Against Ransomware \| #ransomware \| #cybercrime – National Cyber Security Consulting
CERT-EU	a year ago	Cybercriminals Renting WikiLoader to Target Italian Organizations with Banking Trojan \| IT Security News
BankInfoSecurity	a year ago	New Malware WikiLoader Targeting Italian Organizations
CERT-EU	a year ago	Habemus Data Act, the game of musical chairs for DG COMP