{
  "family": "bzub",
  "sample_count": 4,
  "category": "trojan",
  "description": "Trojan:Win32/Bzub is a persistent, highly destructive banking trojan designed specifically to intercept online financial transactions, steal login credentials, and bypass multi-factor authentication. Operating as a Man-in-the-Browser (MitB), it silently manipulates the user's interaction with targeted banking websites to drain funds while displaying a normal interface to the victim.<br><br><b>Understanding Bzub (Banking Trojans)</b><br>To an end-user, Bzub is completely invisible. They will log into their bank account normally, unaware that the trojan is simultaneously logging in behind the scenes, altering transaction details, and hiding the unauthorized transfers from the account balance displayed on the screen. For a financial institution, Bzub represents a severe threat capable of defeating standard anti-fraud measures.<br><br><b>Execution and Web Injection Mechanics</b><br>Bzub is typically distributed via sophisticated spear-phishing campaigns (often using macros or exploit documents) (`T1566.001`). Upon execution, it establishes persistence by modifying Registry Run keys (`T1547.001`). The core functionality involves deep process injection (`T1055`), specifically targeting web browsers (`iexplore.exe`, `chrome.exe`, `firefox.exe`). Once injected, it performs 'Web Injects' (`T1185`): when the user visits a targeted banking URL (retrieved from a configuration file downloaded from the C2 server), the trojan dynamically modifies the HTML/JavaScript of the page. It can present fake login forms, intercept SMS two-factor authentication codes by prompting the user to install a 'security app' on their phone (a mobile malware counterpart), and automatically initiate Wire/ACH transfers.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is catastrophic financial fraud. Host-based IoCs include EDR alerts for 'Suspicious Process Hollowing' or 'API Hooking' targeting major web browsers, and the presence of encrypted `.bin` or `.cfg` files containing the targeted bank URLs. Network IoCs include encrypted beaconing traffic to known botnet C2 panels.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1555.003",
    "T1055",
    "T1185",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1185",
      "name": "Browser Session Hijacking (Man-in-the-Browser / Web Injects)",
      "tactic": "Collection"
    },
    {
      "id": "T1055",
      "name": "Process Injection (Injecting into browser processes)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1555.003",
      "name": "Credentials from Password Stores: Credentials from Web Browsers",
      "tactic": "Credential Access"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint from the network to sever the C2 connection and prevent the attacker from initiating fraudulent transactions.",
    "Contact the victim's financial institutions immediately to freeze accounts and alert them to the high probability of a Man-in-the-Browser compromise.",
    "Assume all web credentials stored on or entered into the machine have been stolen, and mandate enterprise-wide password resets.",
    "Perform a complete wipe and reimage of the infected machine; banking trojans deeply hook into the OS and cannot be reliably removed by AV alone."
  ],
  "what_to_avoid": [
    "Do not rely on standard MFA (like SMS codes) to protect accounts if a banking trojan is suspected, as the attacker is actively intercepting those codes via social engineering.",
    "Avoid allowing the user to log into any sensitive accounts from the compromised machine, even after an AV scan claims it is clean."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}