Keeping an Eye on the Spy Eye Trojan
Summary: Roman Hüssy, curator of the ZeuS-tracking site Zeustracker, launched SpyEye Tracker in November 2010 to help ISPs monitor SpyEye control networks, which his service was following across about 25 distinct botnets versus roughly 100 ZeuS-related botnets still online. Damballa published an analysis of SpyEye's worldwide distribution naming Ukrainian ISPs as the top host of malicious control networks, while SANS published a white paper on code similarities between ZeuS and SpyEye and Trend Micro released the second half of a two-part analysis of the SpyEye web interface.
What's compelling: Hüssy's stated goal is to spotlight SpyEye before it becomes a big threat like ZeuS, and at 25 botnets against ZeuS's 100, the tracking gap is the window in which defenders can still get ahead of it.
Read the original at Krebs on Security ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026