{
  "family": "zeusvm",
  "sample_count": 1,
  "category": "banking_trojan",
  "description": "Trojan-Banker:Win32/ZeusVM (also widely tracked in underground forums as KINS) is a highly sophisticated banking trojan variant derived from the leaked Zeus 2.0.8.9 source code that emerged in mid-2013. Designed to bypass cutting-edge behavioral antivirus heuristics, ZeusVM introduced two groundbreaking technical innovations: a custom virtual-machine-based x86 bytecode interpreter and digital steganography for configuration delivery. The malware encrypts its dynamic banking webinject rules and target bank URLs and embeds them within innocent-looking standard JPEG images hosted on compromised legitimate websites or free image hosting services. When executed, ZeusVM's proprietary virtual machine decrypts and executes the steganographic payload, injecting malicious hooks into Internet Explorer, Mozilla Firefox, and Google Chrome web sessions to perform real-time Man-in-the-Browser (MitB) fund transfers and bypass two-factor authentication (2FA). ZeusVM targeted hundreds of financial institutions across Europe, the United States, and Japan before international law enforcement sinkholing and banking browser defenses curtailed its operations.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "ZeusVM",
    "Zbot.VM",
    "Trojan.ZeusVM",
    "Win32/ZeusVM",
    "KINS",
    "Trojan-Banker.Win32.ZeusVM"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the ZeusVM (KINS) banking trojan?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "ZeusVM is an advanced variant of the Zeus banking trojan that uses image steganography and a custom virtual machine to conceal its webinjects."
      }
    },
    {
      "@type": "Question",
      "name": "How did ZeusVM use image steganography?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "ZeusVM disguised its encrypted configuration files and banking webinject targets inside standard JPEG image files hosted on public web servers."
      }
    },
    {
      "@type": "Question",
      "name": "What is the custom virtual machine inside ZeusVM?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "ZeusVM compiled its core functionality into proprietary bytecode executed by an internal interpreter to confuse reverse engineers and defeat antivirus emulators."
      }
    },
    {
      "@type": "Question",
      "name": "What organizations were targeted by ZeusVM?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "ZeusVM targeted commercial and retail banking institutions across the United States, Germany, the United Kingdom, and Japan."
      }
    },
    {
      "@type": "Question",
      "name": "What vulnerabilities were used to distribute ZeusVM?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "ZeusVM was delivered through exploit kits targeting Microsoft Office vulnerabilities including CVE-2012-0158 and CVE-2013-3906."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1027.003",
    "T1185",
    "T1055.001",
    "T1071.001",
    "T1056.001",
    "T1555.003"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1027.003",
      "name": "Steganography",
      "tactic": "defense-evasion"
    },
    {
      "id": "T1185",
      "name": "Browser Session Hijacking",
      "tactic": "collection"
    },
    {
      "id": "T1055.001",
      "name": "Dynamic-link Library Injection",
      "tactic": "defense-evasion"
    },
    {
      "id": "T1071.001",
      "name": "Web Protocols",
      "tactic": "command-and-control"
    },
    {
      "id": "T1056.001",
      "name": "Keylogging",
      "tactic": "collection"
    },
    {
      "id": "T1555.003",
      "name": "Credentials from Web Browsers",
      "tactic": "credential-access"
    }
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "first_seen": 2013,
  "lineage": {
    "derived_from": [
      "zeus"
    ],
    "variants": [
      "zeusvm v1 (jpeg steganography)",
      "kins v2.0 (commercial modular banker)"
    ]
  },
  "attribution": [
    {
      "actor": "Russian Cybercrime Syndicate",
      "confidence": "high"
    },
    {
      "actor": "KINS Author (Hermes/Max)",
      "confidence": "high"
    }
  ],
  "exploited_cves": [
    "CVE-2012-0158",
    "CVE-2013-3906"
  ],
  "c2_profile": {
    "protocols": [
      "HTTPS",
      "HTTP"
    ],
    "ports": [
      443,
      80
    ],
    "traffic_identifiability": "medium"
  },
  "iocs": {
    "file_hashes": [
      "2f82ba1851b415a782bca8ca2107455cf6433ae6506fbc3b53f0fa752243d467",
      "7c58ab7df0c8f5379b1836171a4f00843657b8599426f8d0ab7cfeb702221b6c"
    ],
    "delivery": [
      "exploit_kits",
      "drive_by_downloads",
      "steganographic_droppers"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
      "Process Injection into explorer.exe"
    ]
  },
  "sources": [
    {
      "name": "Kaspersky Securelist: ZeusVM Steganography in Banking Trojans",
      "url": "https://securelist.com/zeusvm-steganography-in-banking-trojans/58564/"
    },
    {
      "name": "CERT-EU Security Advisory: ZeusVM Financial Malware",
      "url": "https://cert.europa.eu/"
    },
    {
      "name": "NIST National Vulnerability Database CVE-2013-3906",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-3906"
    }
  ],
  "containment_steps": [
    "Terminate injected browser processes and isolate affected corporate banking workstations.",
    "Deploy network inspection proxies to analyze inbound JPEG image streams for embedded encrypted blocks.",
    "Revoke compromised online banking session cookies and reset credentials across all financial portals.",
    "Apply security patches for Microsoft Office memory corruption vulnerability CVE-2012-0158."
  ],
  "what_to_avoid": [
    "Do not allow uninspected image downloads from non-standard image hosting domains on financial endpoints.",
    "Avoid accessing corporate banking portals without hardware-backed multi-factor authentication.",
    "Never bypass antivirus warnings regarding obfuscated bytecode execution."
  ],
  "target_industries": [
    "banking",
    "financial_services",
    "fintech",
    "corporate_accounting"
  ],
  "motivation": "Financial Theft & Man-in-the-Browser Bank Fraud",
  "threat_actors": [
    "KINS Author",
    "Zeus Derivative Developers"
  ],
  "target_geographies": [
    "US",
    "DE",
    "GB",
    "JP",
    "FR",
    "IT"
  ],
  "attack_stage": [
    "initial-access",
    "execution",
    "defense-evasion",
    "credential-access",
    "collection",
    "exfiltration"
  ],
  "ecosystem": [
    "windows",
    "x86",
    "x64"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}