Gozi ISFB Information-Stealing Trojan

They have been distributed via a wide variety of means including mass spam campaigns, spear phishing campaigns, exploit kits and redirection attacks. These campaigns often employ malicious Microsoft Office documents with macros that download the malware when activated.

The malware includes techniques to evade security measures and to bypass behavioural biometric defences, such as by logging the speed at which users type.

One Ursnif variant has been observed using Thread Local Storage (TLS) callbacks to inject itself into other processes such as the Windows Service Host. TLS callbacks allows programs to initialise and terminate variables on a per-thread basis, but they have been exploited to run malicious functions prior to the intended start of execution.

Dreambot uses a Tor client for anonymous and encrypted communication with its command and control servers.

Recent Gozi campaigns have been targeted to specific organisations. They use carefully crafted personalised emails appearing as though they are part of a thread, to give a veneer of legitimacy and increase the likelihood that the malicious attachment is opened. Using the Dark Cloud botnet infrastructure, the threat actors employ new domains and IP addresses for different campaigns and individual emails.