{
  "family": "chthonic",
  "sample_count": 14,
  "category": "banking_trojan",
  "description": "Trojan:Win32/Chthonic is an advanced, highly modular banking trojan and direct evolutionary offshoot of the Zeus (Zbot) codebase discovered by Kaspersky Lab researchers in late 2014. Chthonic represents a hybrid crimeware architecture integrating components from Andromeda and SmokeLoader to deploy encrypted virtual file systems and polymorphic shellcode loaders. The malware specifically targeted over 150 major banking institutions and 20 payment processing gateways across 15 nations, including the United States, United Kingdom, Russia, Japan, Spain, and Italy. Chthonic executes via process hollowing into explorer.exe, msiexec.exe, and svchost.exe, injecting malicious code hooks into Internet Explorer, Mozilla Firefox, and Google Chrome web sessions. Its modular framework features clandestine Virtual Network Computing (hidden VNC) for real-time operator control, remote audio and video capture from connected microphones and webcams, and automated webinjects that manipulate banking DOM elements to bypass two-factor authentication (2FA). Chthonic communications employ AES-256 encrypted C2 channels with dynamic domain generation fallback routines, establishing persistent scheduled tasks and registry Run key autoruns to evade forensic detection.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Chthonic",
    "Trojan.Chthonic",
    "Win32/Chthonic",
    "Zeus Chthonic",
    "Zbot.Chthonic"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Chthonic malware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Chthonic is a sophisticated banking trojan derived from the Zeus malware family, designed to perform automated webinjects, steal financial login credentials, and facilitate remote VNC sessions on infected systems."
      }
    },
    {
      "@type": "Question",
      "name": "How did Chthonic infect target systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Chthonic was predominantly distributed through spear-phishing emails delivering malicious RTF documents weaponized with CVE-2014-1761 and CVE-2014-4114, as well as exploit kits including Angler and Rig."
      }
    },
    {
      "@type": "Question",
      "name": "What industries and organizations were targeted by Chthonic?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Chthonic targeted commercial banks, credit unions, e-commerce payment processors, and online banking customers across 15 countries, primarily in the US, UK, Japan, and Western Europe."
      }
    },
    {
      "@type": "Question",
      "name": "What capabilities distinguish Chthonic from traditional Zeus variants?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Unlike early Zeus releases, Chthonic features modular plugin downloads, hidden VNC remote desktop streaming, encrypted virtual file system storage, and real-time audio/video recording capabilities."
      }
    },
    {
      "@type": "Question",
      "name": "How can organizations detect and mitigate Chthonic infections?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Mitigation requires monitoring for anomalous browser process injections, blocking malicious C2 IP traffic, patching legacy Microsoft Office vulnerabilities, and deploying hardware-backed multi-factor authentication (FIDO2)."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1055.012",
    "T1185",
    "T1056.001",
    "T1071.001",
    "T1113",
    "T1566.001"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1055.012",
      "name": "Process Hollowing",
      "tactic": "defense-evasion"
    },
    {
      "id": "T1185",
      "name": "Browser Session Hijacking",
      "tactic": "collection"
    },
    {
      "id": "T1056.001",
      "name": "Keylogging",
      "tactic": "collection"
    },
    {
      "id": "T1071.001",
      "name": "Web Protocols",
      "tactic": "command-and-control"
    },
    {
      "id": "T1113",
      "name": "Screen Capture",
      "tactic": "collection"
    },
    {
      "id": "T1566.001",
      "name": "Spearphishing Attachment",
      "tactic": "initial-access"
    }
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "first_seen": 2014,
  "lineage": {
    "derived_from": [
      "zeus",
      "andromeda"
    ],
    "variants": [
      "chthonic v1.0",
      "chthonic vnc module",
      "chthonic webinject edition"
    ]
  },
  "attribution": [
    {
      "actor": "Russian-speaking Cybercrime Underground",
      "confidence": "high"
    },
    {
      "actor": "Zeus Derivative Developers",
      "confidence": "high"
    }
  ],
  "exploited_cves": [
    "CVE-2014-1761",
    "CVE-2014-4114"
  ],
  "c2_profile": {
    "protocols": [
      "HTTPS",
      "HTTP"
    ],
    "ports": [
      443,
      80
    ],
    "traffic_identifiability": "medium"
  },
  "iocs": {
    "file_hashes": [
      "4b6c33fef79ebbcce763ffca07fa81215b493c4e3658ebc76b9ee2f8719cb49d",
      "89a27eb2762eb295fe3509bc9f636257a3e7ef7b1bcfd1a7b489d81d6f228b7e"
    ],
    "delivery": [
      "malicious_rtf_exploit",
      "rig_exploit_kit"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
      "Scheduled Tasks"
    ]
  },
  "sources": [
    {
      "name": "Kaspersky Securelist Analysis: Chthonic A New Zeus Clone",
      "url": "https://securelist.com/chthonic-a-new-zeus-clone/68176/"
    },
    {
      "name": "Trend Micro Security Intelligence: Chthonic Banking Trojan",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/chthonic"
    },
    {
      "name": "NIST National Vulnerability Database CVE-2014-1761",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-1761"
    }
  ],
  "containment_steps": [
    "Terminate injected browser processes and isolate endpoint from internal network segments.",
    "Revoke compromised online banking credentials and enforce mandatory out-of-band transaction approvals.",
    "Block inbound network connections matching documented Chthonic C2 IP addresses and dynamic DNS domains.",
    "Apply security patches for Microsoft Office vulnerabilities CVE-2014-1761 and CVE-2014-4114."
  ],
  "what_to_avoid": [
    "Do not enter secondary one-time passwords into browser popups requesting verification during active banking sessions.",
    "Do not execute unverified macros or RTF email attachments received from external senders.",
    "Avoid relying solely on SMS-based 2FA which can be circumvented via browser webinject manipulation."
  ],
  "target_industries": [
    "banking",
    "financial_services",
    "e-commerce",
    "fintech"
  ],
  "motivation": "Financial Theft & Fraud",
  "threat_actors": [
    "Russian Cybercrime Syndicates",
    "Zeus Variant Operators"
  ],
  "target_geographies": [
    "US",
    "GB",
    "RU",
    "JP",
    "ES",
    "IT"
  ],
  "attack_stage": [
    "initial-access",
    "execution",
    "defense-evasion",
    "credential-access",
    "collection",
    "exfiltration"
  ],
  "ecosystem": [
    "windows",
    "x86",
    "x64"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}