GozNym

Executive Summary

GozNym is a sophisticated hybrid banking Trojan combining elements of Nymaim and Gozi ISFB, targeting U.S. and Canadian financial institutions to steal millions in funds. Its integration of stealth persistence mechanisms and banking fraud capabilities makes it a significant threat to the financial sector. IBM X-Force identified its emergence as a critical actor in ongoing financial cybercrime operations.

Goals & Targeting

GozNym’s primary objective is financial exploitation through large-scale banking fraud. It specifically targets financial institutions in the United States and Canada due to their access to high-value financial systems and the potential for significant monetary theft. Operators benefit from the victim’s limited ability to trace transactions, as the malware facilitates stealthy exfiltration of credentials and login sessions. The focus on banks and financial entities underscores a clear intent to monetize infrastructure weaknesses for sustained revenue generation.

GozNym represents a convergence of two well-known malware families, Nymaim and Gozi ISFB, recompiled to exploit the strengths of both. This hybrid malware leverages Nymaim’s advanced stealth and persistence techniques, such as dropper-based infection methods, while incorporating Gozi ISFB’s banking Trojan functionalities, including the ability to compromise web browsers and siphon financial credentials. IBM X-Force observed its deployment in sustained attacks against over 24 banks in North America, resulting in substantial financial losses. The malware’s modular architecture enables operators to adapt to defensive measures, making it particularly resilient and effective in targeting financial institutions. This hybrid approach signifies a strategic evolution in cybercriminal tactics, blending persistence and exfiltration capabilities to maximize illicit gains.

Key Capabilities

• Stealthy persistence mechanisms using droppers and process injection
• Browser-based credential theft and form-filling capabilities
• Evasion of endpoint detection through code obfuscation
• Command-and-control (C2) communication over encrypted channels
• Modular payload execution for adaptive attacks
• Phishing-driven initial compromise via malicious document delivery

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

GozNym operates through sustained campaigns targeting financial institutions, often initiated via spear-phishing emails containing malicious Office documents. Its hybrid nature allows for rapid adaptation to defensive measures, with operators leveraging bulletproof hosting for command-and-control infrastructure. Historical data indicates a focus on North American banks, with operations spanning multiple years and resulting in significant financial losses. The malware’s integration of banking Trojan features suggests a focus on long-term financial exploitation rather than disruptive attacks.

IOC Patterns

• Spear-phishing with macro-laced Office documents
• C2 communication over DNS or HTTPS using fast-flux infrastructure
• Staging of payloads on bulletproof hosting services
• Suspicious registry modifications for persistence
• Unusual browser process injection patterns

Recommended Actions

• Implement advanced email filtering to detect macro-laced phishing documents
• Monitor for suspicious DNS queries and encrypted C2 traffic patterns
• Deploy endpoint detection tools capable of identifying process injection and behavioral anomalies
• Conduct regular employee training on phishing recognition and incident reporting
• Isolate and investigate systems with abnormal login activity or financial transaction patterns
• Collaborate with financial sector threat intelligence sharing groups for real-time IOC updates

Suggested Tags