Banking Trojans & Financial Fraud Implants
Threat Landscape & Operational Overview
Banking Trojans are specialized malicious implants engineered to intercept, manipulate, and steal financial credentials, corporate banking access, and payment authentication tokens. Prominent banking trojan lineages—including Zeus, Qbot, IcedID, TrickBot, and Cerberus—employ browser web-injection (Man-in-the-Browser), deceptive overlay screens, and keystroke logging. Advanced variants bypass Multi-Factor Authentication (MFA) by hijacking session cookies, stealing OTP tokens, or performing automated wire transfer manipulation through Automatic Transfer Systems (ATS).
🛡️ Enterprise Incident Response & Hardening Guidance
Dealing with an active security incident or looking to harden enterprise defenses against this threat class? Read our dedicated operational engineering guide:
→ Open Master Guide: Banking Trojan Protection for BusinessesPrimary MITRE ATT&CK Tactics & Techniques
Observed technical tradecraft, privilege escalation, and persistence patterns mapped across threat families in this category:
| ID | Technique | Tactic | Observed Operational Behavior |
|---|---|---|---|
T1185 |
Browser Session Hijacking | Collection | Injects malicious JavaScript into browser processes to capture login credentials on banking domains. |
T1056.001 |
Keylogging | Collection | Captures raw keystrokes and authentication credentials typed into banking and ERP software. |
T1113 |
Screen Capture | Collection | Takes automated screenshots when banking URLs or financial windows gain focus. |
T1055.004 |
Asynchronous Procedure Call (APC) Injection | Defense Evasion | Injects banking fraud hooks into browser processes. |
T1071.001 |
Web Protocols | Command & Control | Transmits stolen financial records to cybercriminal drop servers. |
Actively Weaponized Exploits & Vulnerabilities (23 CVEs)
Adversaries deploying banking trojans & financial fraud implants frequently weaponize the following software vulnerabilities for initial ingress, privilege escalation, or lateral movement:
Adobe Flash Player ByteArray Use-After-Free (Hacking Team Leak)
Attributed Payloads: blackmoon, goznym, vawtrak
Microsoft Active Directory Netlogon Elevation of Privilege (Zerologon)
Attributed Payloads: qbot
Microsoft Office MSCOMCTL.OCX ActiveX TreeView / ListView Buffer Overflow
Attributed Payloads: carbanak, gozi, shiz +4 more
Microsoft Windows Shell Shortcut LNK / PIF Code Execution (Stuxnet)
Attributed Payloads: carberp, shiz, shylock +1 more
Microsoft Word RTF Parsing Memory Corruption (MS14-017)
Attributed Payloads: carbanak, chthonic, vawtrak
Adobe Flash Player Pixel Bender Shader Buffer Overflow
Attributed Payloads: blackmoon, tinba
Microsoft Office & Windows GDI+ TIFF Parsing Remote Code Execution
Attributed Payloads: carbanak, zeusvm
Microsoft Internet Explorer Peer Factory Use-After-Free Vulnerability
Attributed Payloads: carberp, zbot
SOC Incident Containment Checklist
Standard operating triage procedure for security teams responding to suspicious or confirmed infections in this category:
- Immediately notify corporate treasury, financial institutions, and bank account representatives to freeze transaction privileges.
- Terminate active browser sessions and revoke all enterprise OAuth and single sign-on (SSO) web session cookies.
- Capture browser memory heaps and analyze loaded DLLs for Man-in-the-Browser hooks.
- Audit financial software and ERP endpoints for secondary backdoor installations.
- Re-issue hardware authentication tokens and change all corporate banking portal credentials from a sanitized device.
- Do not perform financial transactions on potentially compromised workstations.
- Do not assume that changing passwords without revoking active session cookies neutralizes the threat.
Prominent Malware Families in this Category
Top documented threats ranked by historical prevalence and behavioral signatures:
zbot
Zbot (universally known as Zeus, and documented under variants such as Zeus Panda, GameOver Zeus, and Wsnpoem) is arguably the most influ...
zusy
Tinba (formally designated in AV classification as Zusy or IlliBanker, and colloquially celebrated as the 'Tiny Banker') is a notoriously...
ursnif
Ursnif (also widely known by its underlying codebase names Gozi and ISFB) is one of the most enduring and technically sophisticated banki...
qbot
QakBot (widely referenced as Qbot or Pinkslipbot) is an aggressive, modular banking trojan and malware loader that operated for over 16 y...
tinba
Trojan:Win32/Tinba (short for 'Tiny Banker', also cataloged by vendors as Zusy) is a landmark banking trojan famous for its remarkably mi...
shiz
Trojan-Banker:Win32/Shiz is a notorious, historically significant Russian banking trojan that served as a critical evolutionary link conn...
blackmoon
Trojan:Win32/Blackmoon (widely designated in cybersecurity research as KRBanker) is a destructive, regionally focused banking trojan that...
spyeye
SpyEye (cataloged across security vendors as Trojan:Win32/SpyEye, Win32/SpyEye, and TSPY_SPYEYE) is one of the most notorious and commerc...
Complete Directory (33 Families)
Alphabetical index of all tracked malware families cataloged under banking trojans & financial fraud implants: