Gozi

Internal ID: win.gozi

aliases

Last seen:Mar 17, 2026

Intelligence Profile

2000 Ursnif aka Snifula

2006 Gozi v1.0, Gozi CRM, CRM, Papras

2010 Gozi v2.0, Gozi ISFB, ISFB, Pandemyia(*)

-> 2010 Gozi Prinimalka -> Vawtrak/Neverquest

In 2006, Gozi v1.0 ('Gozi CRM' aka 'CRM') aka Papras was first observed.

It was offered as a CaaS, known as 76Service. This first version of Gozi was developed by Nikita Kurmin, and he borrowed code from Ursnif aka Snifula, a spyware developed by Alexey Ivanov around 2000, and some other kits. Gozi v1.0 thus had a formgrabber module and often is classified as Ursnif aka Snifula.

In September 2010, the source code of a particular Gozi CRM dll version was leaked, which led to Vawtrak/Neverquest (in combination with Pony) via Gozi Prinimalka (a slightly modified Gozi v1.0) and Gozi v2.0 (aka 'Gozi ISFB' aka 'ISFB' aka Pandemyia). This version came with a webinject module.

Threat Analysis

Gozi is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→http://blog.malwaremustdie.org/2013/02/the-infection-of-styx-exploit-kit.html

→http://researchcenter.paloaltonetworks.com/2017/02/unit42-banking-trojans-ursnif-global-distribution-networks-identified/

→https://0xc0decafe.com/malware-analyst-guide-to-pe-timestamps/

→https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/gozi-italian-shellcode-dance

→https://0xtoxin.github.io/threat%20breakdown/Gozi-Italy-Campaign/

→https://blog.gdatasoftware.com/2016/11/29325-analysis-ursnif-spying-on-your-data-since-2007

→https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/

→https://blog.talosintelligence.com/2020/12/2020-year-in-malware.html

→https://github.com/mlodic/ursnif_beacon_decryptor

→https://kostas-ts.medium.com/ursnif-vs-italy-il-pdf-del-destino-5c83d6281072

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.gozi

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Gozi