P2P ZeuS
MITRE ATT&CK: S0016 View on attack.mitre.org
Aliases: Peer-to-Peer ZeuS, Gameover ZeuS, P2P ZeuS
- First seen
- 2011-05-01 00:00:00
- Malware type
- botnet, credential-stealer, trojan
- Family
- Malware family
- Operating systems
- windows
- Related IoCs
- 14 (5 malicious)
- Last IoC activity
- 2026-10-18 03:21:23
- Profile updated
- 2026-07-07 15:28:07
Targeted industries: financial-services
Context
P2P ZeuS is a closed-source fork of the leaked version of the ZeuS botnet. It presents improvements over the leaked version, including a peer-to-peer architecture.
Recent IoC activity
5 malicious indicators in Maltiverse are attributed to P2P ZeuS (S0016). The 5 most recently updated:
| Type | Indicator | Updated | Sources |
|---|---|---|---|
| hostname | living-start.at | 2026-10-18 | 2 |
| hostname | news-deck.at | 2026-10-18 | 3 |
| hostname | liloptyp.at | 2026-10-06 | 1 |
| hostname | shoutdidthus.live | 2026-09-30 | 1 |
| hostname | pagribaf24.com | 2026-09-16 | 3 |
Malware & tools used
- Junk Data (attack-pattern)
Reports & references
- MITRE ATT&CK — S0016 (report)
- secureworks.com — The Lifecycle Of Peer To Peer Gameover Zeus (report)