The Patching Friars' AlmanacA calendar of CVE saints
GameOver ZeusHoly card for d-gameover-zeus, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 GameOver Zeus OLYMPUS DISPERSUS
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Circle II · Legions (botnets)

The Demon GameOver Zeus, Zeus Without a Central Olympus

Legend

A peer-to-peer variant of the ZeuS banking trojan, active from 2011 and run by Evgeniy Bogachev's group, it stole online banking credentials and distributed CryptoLocker ransomware. With no central server to knock down it thought itself invincible, and losses exceeded $100 million. On 2 June 2014 Operation Tovar, led by the FBI and DOJ with Europol, the NCA and private partners, broke the network; Bogachev is still on the FBI's most-wanted list.

Exorcism

Cast it out by confirming transfers on a separate channel the trojan cannot touch. Keep endpoints patched with EDR running, and block known command-and-control domains as well as the ones spawned by its DGA.

Technical record

Also known as
P2P ZeuS, GOZ, Peer-to-Peer Zeus
Circle
Circle II · Legions (botnets) · Circle VI · Banking trojans and infostealers
First seen
2011
Status
Exorcised (Operation Tovar, 2014-06-02)
Works
The Miracle of Operation Tovar · The Miracle of the Halted Avalanche

A peer-to-peer variant of the ZeuS banking trojan operated by Evgeniy Bogachev's group, used to steal online banking credentials and to distribute CryptoLocker ransomware. Its decentralised design made it resilient to takedown. The US-led Operation Tovar disrupted both GameOver Zeus and CryptoLocker in June 2014, and Bogachev remains on the FBI's most-wanted list.

Sources: attack.mitre.org · justice.gov · MITRE ATT&CK reference S0016

© The MITRE Corporation. ATT&CK® information is reproduced and distributed with the permission of The MITRE Corporation.

📅 Add to your calendar

Saints:Google CalendarApple, Outlook and others (.ics)

Observances (feasts, scourges and miracles):Google CalendarApple, Outlook and others (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.