Not So Crystal Clear - Zeus Variant Spoils Ukrainian Holiday
Summary: Talos reported that attackers used the compromised website of Ukrainian accounting software developer Crystal Finance Millennium to host a ZeuS banking trojan payload, delivered through spam emails containing a ZIP archive with a JavaScript downloader. Talos sinkholed one of the command-and-control domains and logged 11,925,626 beacons from 3,165 unique IP addresses, with most infected systems in Ukraine and the United States second, and PJSC Ukrtelecom the most heavily affected ISP.
Key Takeaway: The sinkhole counted 3,165 unique IP addresses beaconing from a single campaign that rode a trusted accounting vendor's site during Ukraine's Independence Day holiday - a reminder that the trust relationship with a software supplier is the foothold, not the perimeter.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026