Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
D’après Group-IB, Carbanak aurait souscrit à des services de botnets (tels que GoZ, Shiz et Ranbyus).
7 distinct techniques documented for this family, organized by ATT&CK tactic.
The principal purpose of GOZ is to capture banking credentials from infected computers. One means by which GOZ accomplishes this is through ... attacks, in which GOZ intercepts sensitive information victims transmit from their computers.
the Defendants use GOZ to inject additional code into victims' web browsers that changes the appearance of the websites victims are viewing. For example, if a GOZ-infected user were to visit a banking website that typically requests only a username and password, the defendants could seamlessly inject additional form fields into the website displayed in the user's web browser that also request the user's social security number, credit card numbers, and other sensitive information.
The principal purpose of GOZ is to capture banking credentials from infected computers. One means by which GOZ accomplishes this is through ... attacks, in which GOZ intercepts sensitive information victims transmit from their computers.
the Defendants use GOZ to inject additional code into victims' web browsers that changes the appearance of the websites victims are viewing. For example, if a GOZ-infected user were to visit a banking website that typically requests only a username and password, the defendants could seamlessly inject additional form fields into the website displayed in the user's web browser that also request the user's social security number, credit card numbers, and other sensitive information.
Individual infected computers, or "bots," are controlled remotely through a decentralized command and control ("C&C") system in which (a) ordinary infected computers, or "peers," remain in contact with each other; (b) specially selected peers called "proxy nodes" transmit commands and other information from the Defendants to the peers; and (c) a Domain Generation Algorithm ("DGA") is used to generate a large number of Internet domain names with which the infected computers communicate at least once a week.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
GOZ uses a domain generation algorithm (DGA) to produce large numbers of domains for command-and-control communication, making sinkholing and long-term botnet disruption difficult. The content describes it as malware distributed via spam campaigns and tracked through sinkholed domains to estimate infected hosts.
Botnet/banking trojan service mentioned as part of services used by the precursor group.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.