Zeus Panda

Executive Summary

Zeus Panda is a banking Trojan that steals credentials through keylogging and web form injection, persisting via registry run keys and scheduled tasks. It exfiltrates data over HTTPS to evade detection. The leak of its source code in 2011 has fueled widespread variant creation across Windows platforms.

Zeus Panda is a banking Trojan that exploits Windows operating systems ranging from XP to 10. The malware was originally released by the Zeus family and its source code leaked in 2011, providing threat actors with a template for developing new variants. Once installed, Zeus Panda targets web browsers to surreptitiously inject malicious forms or monitor keystrokes, thereby harvesting bank logins, credit card numbers, and other sensitive credentials. The Trojan also captures screenshots and can record clipboard contents, enabling it to recover authentication tokens that are often stored in memory by popular banking applications. Exfiltration occurs over encrypted HTTP/HTTPS channels directed at a compromised command‑and‑control (C2) server. Persistence is achieved through registry run keys and scheduled tasks so that the malware remains active across reboots. Variants may also employ dynamic DNS for C2 discovery, making them harder to track. Overall, Zeus Panda functions as a modular exploit kit: it gathers credentials via keylogging and form injection, maintains persistence, and delivers stolen data back to attackers. The leaked codebase has led to a proliferation of versions in the wild, many of which simply replicate older Zeus behaviors but may add new components such as malware‑as‑a‑service or botnet integration.

Key Capabilities

• Steals bank login credentials by injecting malicious forms into browsers
• Keylogging to capture user input, including passwords and sensitive data
• Screenshots and clipboard monitoring for additional credential leakage
• PERSISTENCE via registry run keys and scheduled tasks
• Exfiltration of stolen data over encrypted HTTPS channels
• Modular architecture allowing attackers to add or reconfigure modules with relative ease

ATT&CK Techniques

Recommended Actions

• Deploy endpoint detection & response (EDR) solutions capable of identifying Zeus‑family indicators such as known process names and YARA signatures
• Monitor outbound connections for suspicious HTTPS activity to unfamiliar domains or IPs, filtering per threat‑intel feeds
• Implement application whitelisting to block execution of unsigned binaries on Windows platforms
• Patch legacy features (e.g., outdated IE and Flash) that are often used for web injection
• Use network segmentation and strict firewall rules to limit lateral movement
• Conduct user security awareness training focused on phishing and credential theft
• Apply the latest Windows OS patches, including disabling older authentication protocols prone to exploitation

Suggested Tags