Threat Actor: Gozi ISFB Banking Syndicate
Gozi ISFB Banking Syndicate is classified as an advanced Organized Cybercrime Syndicate originating primarily from Russia / Latvia / Romania (Nikita Kuzmin, Deniss Calovskis, Mihai Paunescu). Driven by operational objectives spanning webinject financial theft, wire redirection & millions stolen from global accounts, this threat entity has maintained an active footprint from 2007 - Present. In enterprise telemetry and malware repository classification, Gozi ISFB Banking Syndicate has been corroborated across 2 distinct malware families with over 8,301 validated sample hashes.
Operational Threat Profile & Targeting
| Known Aliases | ISFB Operators, 76 Service, Ursnif Ancestor Syndicate |
|---|---|
| Targeted Sectors | US Federal Agencies (NASA), Global Banking Institutions, Credit Unions |
| Primary Motivations | Webinject Financial Theft, Wire Redirection & Millions Stolen from Global Accounts |
| Dominant Payload Categories | Banking Trojan |
| MITRE ATT&CK Reference | https://attack.mitre.org/software/S0484/ ↗ |
Primary Observed MITRE ATT&CK Tradecraft
The following offensive techniques have been empirically verified across implants and campaign tooling weaponized by Gozi ISFB Banking Syndicate:
T1185— weaponized across 2 catalog payload(s)T1071.001— weaponized across 2 catalog payload(s)T1566.001— weaponized across 2 catalog payload(s)T1055.001— weaponized across 1 catalog payload(s)T1555.003— weaponized across 1 catalog payload(s)T1056.001— weaponized across 1 catalog payload(s)T1055— weaponized across 1 catalog payload(s)T1547.001— weaponized across 1 catalog payload(s)T1005— weaponized across 1 catalog payload(s)T1027— weaponized across 1 catalog payload(s)
Exploited Vulnerabilities (CVEs)
Telemetry confirms Gozi ISFB Banking Syndicate has actively weaponized the following Common Vulnerabilities and Exposures in enterprise intrusions:
- CVE-2012-0158 — Technical Dossier & Exploitation Analysis (NVD ↗)
- CVE-2016-0189 — Technical Dossier & Exploitation Analysis (NVD ↗)
- CVE-2017-0199 — Technical Dossier & Exploitation Analysis (NVD ↗)
- CVE-2017-11882 — Technical Dossier & Exploitation Analysis (NVD ↗)
Attributed Catalog Malware Families (2 Families)
The following malware implants in the SystemHelpDesk catalog have been verified in operational campaigns attributed to Gozi ISFB Banking Syndicate:
| Family | Category | Sample Count | Technical Summary |
|---|---|---|---|
| ursnif | Banking Trojan | 8,188 | Ursnif (also widely known by its underlying codebase names Gozi and ISFB) is one of the most enduring and technically sophisticated banking trojans and modular ... |
| gozi | Banking Trojan | 113 | Trojan:Win32/Gozi (also universally tracked as ISFB and the Ursnif family tree) is one of the most historically significant, resilient banking trojans in comput... |
Official US Federal & CISA Advisories
Official intelligence alerts and joint cybersecurity advisories published regarding Gozi ISFB Banking Syndicate operations:
SOC Hardening & Defensive Containment
Defending enterprise perimeters against campaigns staged by Gozi ISFB Banking Syndicate requires defense-in-depth posture enforcement:
- Egress Filtering & C2 Interception: Enforce strict egress inspection and block communication to unclassified external IP blocks, fast-flux proxy relays, and dynamic DNS providers.
- Credential Isolation & Privileged Access Management: Enforce FIDO2 hardware MFA across all administrative and VPN entry points to prevent session token hijacking and password reuse.
- Attack Surface Reduction & Patch Velocity: Prioritize remediation of public-facing edge network appliances (VPN concentrators, web servers, file transfer appliances).