Trusted Design

Zeus Sphinx Pushes Empty Configuration Files

概要

Recent Zeus Sphinx samples have fetched configuration files in which all the target URLs were removed. This means that while Sphinx infection campaigns continue and the malware can infect new machines, it remains idle and lacks attack instructions to target specific banks and banking services. The only instruction that repeats in all Sphinx configuration is to inject a victim’s “bot ID” into every page he or she visits. In essence, this is a web injection attack: Inject into http*://*, covering any HTTP and HTTPS webpage the victim browses to. This phase of empty Sphinx configuration files started in March 2017 and increased over the past few months to include all Sphinx samples. This suggests that Sphinx is presently operated by one group, not multiple actors, despite the fact that it was commercially sold in the underground when it was launched in 2015.

Created: 2026-02-23

Indicators

Indicatorsは見つかっていない。

類似Pulses

• Zeus Variant - Sphinx (score: 0.59)
• KINS C2 Panel (score: 0.54)
• Zeus Malware Hashes and C2 config URL (score: 0.54)
• FBI FLASH 66 CONUS - Brobot, Kamikaze/Toxin (score: 0.53)
• Sphinx Moth: New IOC's on Wild Neutron/Morpho APT (score: 0.53)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る