{
  "family": "gozi",
  "sample_count": 113,
  "category": "banking_trojan",
  "description": "Trojan:Win32/Gozi (also known as Ursnif or ISFB) is one of the most sophisticated, enduring, and financially devastating banking trojans in cybersecurity history.<br><br><b>Understanding Gozi (Ursnif)</b><br>For the general public, a Gozi infection results in emptied bank accounts and stolen identities. For cybersecurity experts, Gozi represents a masterclass in malware engineering. Its leaked source code in 2010 spawned numerous variants, making it a cornerstone of modern financial cybercrime. It is specifically designed to steal banking credentials, intercept two-factor authentication (2FA) codes, and execute fraudulent transactions via web injects.<br><br><b>Execution and Evasion Strategies</b><br>Gozi is typically distributed via highly targeted spearphishing campaigns containing weaponized Office documents (macros) or through exploit kits like RIG or Angler. Once executed, Gozi uses advanced evasion techniques; it often stores its configurations and payloads encrypted within the Windows Registry rather than the file system (fileless malware techniques). It achieves persistence by modifying the <code>AppInit_DLLs</code> registry key or utilizing COM hijacking. <br><br><b>Indicators of Compromise & Impact</b><br>Once active, Gozi injects its core modules into web browsers (IE, Chrome, Firefox). When a victim navigates to a targeted banking portal, Gozi uses 'web injects' to alter the HTML of the banking site on-the-fly, prompting the user for additional sensitive information (like PINs or secure tokens). Incident responders tracking Gozi should analyze memory for injected browser DLLs, hunt for anomalous outbound traffic to Fast Flux C2 networks, and monitor for hidden registry keys containing large blobs of encrypted data.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1566.001",
    "T1185",
    "T1546.015",
    "T1055.001",
    "T1111"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1055.001",
      "name": "Process Injection: Dynamic-link Library Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1185",
      "name": "Browser Session Hijacking",
      "tactic": "Collection"
    },
    {
      "id": "T1546.015",
      "name": "Event Triggered Execution: Component Object Model Hijacking",
      "tactic": "Privilege Escalation"
    },
    {
      "id": "T1111",
      "name": "Two-Factor Authentication Interception",
      "tactic": "Credential Access"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Immediately sever the endpoint's network connection to halt active financial theft and data exfiltration.",
    "Force a mandatory password reset for all financial, corporate, and personal accounts accessed from the infected host.",
    "Capture a forensic image of the system's RAM; memory analysis is often the only way to extract Gozi's decrypted web injects and C2 configuration.",
    "Perform a clean installation (reimage) of the operating system, as Gozi's deep system hooks and fileless registry persistence are extremely difficult to eradicate manually."
  ],
  "what_to_avoid": [
    "Do not attempt to remediate a Gozi infection using standard AV tools; its advanced rootkit capabilities often hide its true presence.",
    "Do not log into any accounts on the infected machine, as the web injects and keyloggers are highly effective at capturing real-time credentials."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}