The source code and a manual for the Zeus crimeware framework have been leaked, allowing defenders a peak inside the infamous crime kit's infrastructure but perhaps giving attackers better ideas. The source code and a manual to the popular crimeware creation kit Zeus has been leaked, perhaps giving defenders additional tools to fight infections but also raising concerns that criminals may use the source code to create a rapidly expanding compendium of variants.Nearly a week ago, copies of the source code to Zeus appeared on the Internet, according to Danish security firm CSIS. The release comes about the same time that a manual describing Zeus’s functionality also appeared on the Web. While having access to the source code could be a boon to researchers, security professionals also worried that having access to the code could result in a spurt of innovation among criminals.“It remains to be seen whether we see different flavors of Zeus appearing over the next few days, weeks or even months,” says Paul Wood, senior analyst with Symantec.cloud. “Of course, the ability then is for the other bad guys to take advantage of some of the technology that they don’t have in their tool kit and build that into their own technology, because there are certainly a quite a lot of interesting features in the Zeus toolkit.”In 2004, the creator of the Agobot bot software posted his code to the public. Soon after, Agobot variants skyrocketed, turning the code for the software into one of the largest families of malware detected on the Internet. Zeus is already popular and is frequently used as the means to steal money from victims’ bank accounts. Yet, the source code could help criminals create more variations on the source code, says Wood.The release of the code comes around the same time as the publication of a manual for the software. In a tweet on Wednesday, Mikko Hyponnen, chief research officer for security firm F-Secure, highlighted the document. “Gives a good idea on how organized these guys are,” he posted.Yet, the public outing of both the source code and manual can help defenders create better ways of detecting variants of the Zeus code, says Symantec.cloud’s Wood.“The other side of the coin really is the ability to understand how these components are generated by looking at the source code, which enables us to put in place better rules to identify that type of malicious activity,” Wood says. “If we can understand a bit about how they work, that allows us to build better rules to detect them.Unfortunately, the code has not yet revealed much about the author or authors. In an analysis posted on Wednesday, Derek M. Jones, a visiting professor at Kingston University focusing on forensics software engineering, concluded that there is a single author who had some professional development experience and had very strong English skills. Extending those conclusions is difficult, he says.“There has been some research where people have tried to do some author attribution,” he says. “But the problem is that people look for patterns, but in code, there is not a lot of patterns.”Or, as F-Secure Hypponen deadpans, “They’re Russian. That should help us a lot in finding them.” Related content news Multibillion-dollar cybersecurity training market fails to fix the supply-demand imbalance Despite money pouring into programs around the world, training organizations have not managed to ensure employment for professionals, while entry-level professionals are finding it hard to land a job By Samira Sarraf Oct 02, 2023 6 mins CSO and CISO CSO and CISO CSO and CISO news Royal family’s website suffers Russia-linked cyberattack Pro-Russian hacker group KillNet took responsibility for the attack days after King Charles condemned the invasion of Ukraine. By Michael Hill Oct 02, 2023 2 mins DDoS Cyberattacks feature 10 things you should know about navigating the dark web A lot can be found in the shadows of the internet from sensitive stolen data to attack tools for sale, the dark web is a trove of risks for enterprises. Here are a few things to know and navigate safely. By Rosalyn Page Oct 02, 2023 13 mins Cybercrime Security news ShadowSyndicate Cybercrime gang has used 7 ransomware families over the past year Researchers from Group-IB believe it's likely the group is an independent affiliate working for multiple ransomware-as-a-service operations By Lucian Constantin Oct 02, 2023 4 mins Hacker Groups Ransomware Cybercrime Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe