Gameover ZeuS

Not to be confused with Zeus (malware).

Gameover ZeuS is a peer-to-peer botnet based on components from the earlier ZeuS trojan. It is believed to have been spread through use of the Cutwail botnet.

Unlike its predecessor the ZeuS trojan, Gameover ZeuS uses an encrypted peer-to-peer communication system to communicate between its nodes and its command and control servers, greatly reducing its vulnerability to law enforcement operations. The algorithm used appears to be modeled on the Kademlia P2P protocol.

According to a report by Symantec, Gameover Zeus has largely been used for banking fraud and distribution of the CryptoLocker ransomware.

In early June 2014, the U.S. Department of Justice announced that an international inter-agency collaboration named Operation Tovar had succeeded in temporarily cutting communication between Gameover ZeuS and its command and control servers.

On 24 February 2015, the FBI announced a reward of up to $3 million in exchange for information regarding Russian cyber criminal Evgeniy Bogachev over his association with Gameover ZeuS.

Bitdefender has identified two Gameover ZeuS variants in the wild: one of them generates 1,000 domains per day and the other generates 10,000 per day.

Fox-IT helped to end the Gameover ZeuS criminal network.

See also

• Conficker
• Command and control (malware)
• Operation Tovar
• Timeline of computer viruses and worms
• Tiny Banker Trojan
• Torpig
• Zeus (malware)
• Zombie (computer science)