Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
Cutwail was populated by Pushdo infections; the two malware families were described as working together.
Explicit Confidence 97% · Jack Rhysider EP 110 Details
“Google used a Trojan called Pushdo to infiltrate Windows computers and get the Cutwail spam engine running on them.”
Gameover ZeuS Trojan USES Cutwail
Jack says Gameover ZeuS was installed on millions of computers using the Cutwail botnet.
Explicit Confidence 96% · Jack Rhysider EP 110 Details
“It was installed on millions of computers using Pushdo and the Cutwail botnet.”
Gameover ZeuS ATTRIBUTED_TO Evgeniy Bogachev
The FBI charged Evgeniy Bogachev with being an administrator of the Gameover ZeuS botnet.
Explicit Confidence 99% · James Cole EP 111 Details
“Evgeniy Bogachev, a Russian national, has been indicted in Pittsburgh, Pennsylvania for his role as an administrator of the Gameover ZeuS botnet”
SpyEye DEVELOPED_BY Aleksandr Panin
Aleksandr Panin, known as Gribodemon, was identified as the creator of SpyEye and pleaded guilty to creating it.
Explicit Confidence 99% · Jack Rhysider EP 111 Details
“Gribodemon’s real name was Aleksandr Panin”
“was sentenced to nine years in prison for creating the SpyEye malware”
Jack identifies Slavik as the author and mastermind behind ZeuS.
Explicit Confidence 96% · Jack Rhysider EP 111 Details
“That author was the young Russian going by the name of Slavik”
“Slavik had used many different usernames on the web, but he was often seen talking about ZeuS, and took ownership as the author”
Operation Clean Slate INVOLVES Secureworks
Dell Secureworks was listed as a private-sector partner in the Gameover ZeuS operation.
Explicit Confidence 98% · Bob Anderson EP 111 Details
“Dell Secure Works, CrowdStrike”
Operation Clean Slate INVOLVES Federal Bureau of Investigation
The FBI led or participated in Operation Clean Slate and the Gameover ZeuS disruption.
Explicit Confidence 99% · Bob Anderson EP 111 Details
“The FBI’s Pittsburgh, Omaha, and Washington field offices have led the Gameover ZeuS investigation”
Operation Clean Slate INVOLVES CryptoLocker
The coordinated seizure and disruption targeted infrastructure supporting both Gameover ZeuS and CryptoLocker.
Explicit Confidence 99% · Leslie Caldwell EP 111 Details
“computer servers around the world that had backbone of both Gameover ZeuS and CryptoLocker”
Operation Clean Slate INVOLVES Gameover ZeuS
Operation Clean Slate was the operation associated with the coordinated disruption of the Gameover ZeuS botnet.
Explicit Confidence 99% · Bob Anderson EP 111 Details
“Today’s actions are part of an operation called Clean Slate”
“Gameover ZeuS investigation”
Operation Clean Slate INVOLVES CrowdStrike
CrowdStrike was listed as a private-sector partner in the Gameover ZeuS operation.
Explicit Confidence 98% · Bob Anderson EP 111 Details
“Dell Secure Works, CrowdStrike”
Operation Clean Slate INVOLVES Microsoft Digital Crime Unit
Microsoft was among the private-sector partners assisting the Gameover ZeuS operation.
Explicit Confidence 98% · Bob Anderson EP 111 Details
“Among the many private sector partners who assisted by helping victims remediate the damage to their computers infected by the Gameover ZeuS botnet are as follows; the Microsoft Corporation”
The malware first called Zbot, short for ZeuS Bot, later became known simply as ZeuS.
Explicit Confidence 99% · Jack Rhysider EP 111 Details
“now it was being called Zbot, short for ZeuS Bot”
“By 2008, Zbot became known just as ZeuS”
Slavik SAME_AS Evgeniy Bogachev
Jack states that the real identity of Slavik was Evgeniy Bogachev.
Explicit Confidence 99% · Jack Rhysider EP 111 Details
“the FBI discovered the real identity of Slavik. His name was Evgeniy Bogachev”
Rock Phish USES ZeuS
Rock Phish added ZeuS to its phishing operations and pushed it with phishing emails.
Explicit Confidence 99% · Jack Rhysider EP 111 Details
“by 2008, they were adding ZeuS to their arsenal”
“Rock Phish began pushing the ZeuS malware out along with their phishing e-mails”
ZeuS USES ZeuS Builder
The ZeuS crimeware kit included ZeuS Builder, which configured the behavior of bots.
Explicit Confidence 99% · Jack Rhysider EP 111 Details
“the ZeuS crimeware kit came with ZeuS Builder”
ZeuS USES malware as a service
ZeuS Version 3 was offered as malware as a service.
Explicit Confidence 99% · Jack Rhysider EP 111 Details
“ZeuS Version 3, and it was the first online banking malware to be offered as a service, MAAS, malware as a service”
Avalanche used ZeuS as a credential thief and botnet.
Explicit Confidence 95% · Jack Rhysider EP 111 Details
“Avalanche liked ZeuS too”
The transcript says ZeuS and Cutwail were integrated with each other, combining their capabilities.
Explicit Confidence 98% · Jack Rhysider EP 111 Details
“The Cutwail botnet, along with its friendly loader Pushdo, eventually integrated ZeuS into it, and ZeuS integrated Cutwail into it”
Gameover ZeuS USES peer-to-peer capability
Gameover ZeuS had peer-to-peer capability.
Explicit Confidence 99% · Jack Rhysider EP 111 Details
“Gameover ZeuS ... had peer-to-peer capability”
ZeuS USES man-in-the-browser attack
ZeuS could conduct man-in-the-browser attacks by altering rendered web pages and requesting additional sensitive information.
Explicit Confidence 99% · Jack Rhysider EP 111 Details
“ZeuS was able to carry out man-in-the-browser attacks”
JabberZeuS USES backconnect module
JabberZeuS offered a backconnect module that redirected tracing of fraudulent transfers through the infected computer.
Explicit Confidence 99% · Jack Rhysider EP 111 Details
“the backconnect module, which was $1,500 and allowed the hacker to redirect any tracing of their transfers out of bank accounts back into the infected computer itself”
Gameover ZeuS USES sinkholing
Gameover ZeuS was subjected to coordinated sinkholing attempts, although the attempts did not fully take down the botnet.
Explicit Confidence 88% · Jack Rhysider EP 111 Details
“the coordinated sinkholing of domains was executed, but it did not take down the ZeuS botnet”
JabberZeuS VARIANT_OF ZeuS
JabberZeuS was presented as the next major version of ZeuS, with additional modules and features.
Explicit Confidence 99% · Jack Rhysider EP 111 Details
“wrote the next big version of ZeuS. This would be called JabberZeuS”
SpyEye was made by modifying ZeuS.
Explicit Confidence 99% · Jack Rhysider EP 111 Details
“Gribodemon and Harderman took ZeuS and modified it to make a new malware called SpyEye”
ZeuS V2 was a later version of ZeuS with expanded surveillance and banking capabilities.
Explicit Confidence 99% · Jack Rhysider EP 111 Details
“He went on to add even more new features and came out with ZeuS V2”