Citadel

Citadel is a Windows banking Trojan derived from Zeus and first identified in 2011.

Citadel

Family profile

Citadel is a Windows banking Trojan derived from Zeus and first identified in 2011. It is used by financially motivated cybercriminals to harvest credentials and facilitate fraudulent transactions against online banking customers worldwide. Its capabilities include keylogging, credential theft targeting password managers, browser web injections, and video capture of the victim’s screen. Citadel-compatible web injections support automated banking fraud, while screen recording gives operators visibility into victims’ banking activity. The malware also employs defense-evasion techniques to hinder detection.

Citadel has operated through criminal botnets and infrastructure supplied by bulletproof hosting providers. Its campaigns have affected companies and financial institutions, including U.S. victims. It has also been distributed alongside Reveton ransomware in drive-by infection campaigns; Citadel’s banking and credential-theft functions are distinct from Reveton’s screen-locking extortion behavior. In 2013, Microsoft’s Digital Crimes Unit coordinated with the FBI to disrupt Citadel botnets under a civil seizure order.

Capabilities

Credential Theft
Defense Evasion
Keylogging

Samples

Recent samples

1 sandbox sample in the Derp library, newest 1 shown

5aa8cfb7d84826ce6232982680b7fd874a3a8b096e631c85fb8a75a55a6166c5

Analysed Oct 5, 2026Triage report

Exploited software

Vulnerabilities linked to Citadel

7 CVEs

CVE-2012-1723 Oracle Java HotSpot Applet Bytecode Verifier Remote Code Execution CVE-2010-0188 Adobe Reader and Acrobat LibTIFF Memory Corruption CVE-2012-4681 Oracle Java 7 SecurityManager Sandbox Bypass Remote Code Execution CVE-2013-2493 Denial of Service in Google Chrome Frame Hook_Terminate CVE-2012-5076 Oracle Java JRE JAX-WS Bytecode Bypass Vulnerability CVE-2011-3544 Oracle Java Rhino Script Engine Sandbox Escape and Remote Code Execution CVE-2012-0507 Java AtomicReferenceArray Type Confusion and Sandbox Escape

MITRE ATT&CK

Citadel in ATT&CK

33 distinct techniques

Techniques

33 techniques

T1485 Data Destruction T1189 Drive-by Compromise T1113 Screen Capture T1027 Obfuscated Files or Information T1125 Video Capture T1565.001 Stored Data Manipulation T1056.004 Credential API Hooking T1649 Steal or Forge Authentication Certificates T1005 Data from Local System T1070 Indicator Removal T1056.001 Keylogging T1566 Phishing T1555 Credentials from Password Stores T1090 Proxy T1204 User Execution T1059 Command and Scripting Interpreter T1082 System Information Discovery T1021.005 VNC T1105 Ingress Tool Transfer T1083 File and Directory Discovery T1046 Network Service Discovery T1539 Steal Web Session Cookie T1583 Acquire Infrastructure T1190 Exploit Public-Facing Application T1497 Virtualization/Sandbox Evasion T1568 Dynamic Resolution T1584.005 Botnet T1203 Exploitation for Client Execution T1078 Valid Accounts T1071 Application Layer Protocol T1566.001 Spearphishing Attachment T1568.001 Fast Flux DNS T1071.001 Web Protocols

Reporting

Research mentioning Citadel

Aug 26

Security Affairs

Sphinx, a new variant of Zeus available for sale

A malware seller advertised Sphinx, a banking trojan derived from the leaked ZeuS source code, as a new crimeware offering on underground forums. The malware was written in C++ and promoted as operating entirely over the Tor network, with the seller claiming it was resistant to sinkholing, blacklisting, and traditional ZeuS tracking efforts associated with infrastructure-monitoring projects such as Zeus Tracker. The offering included a broad set of banking-fraud features commonly associated with ZeuS-style malware, including form grabbing, webinjects, webfakes, keylogging, certificate theft, reverse SOCKS, and hidden VNC access to victim machines. Buyers were offered binaries for $500 each, payable in Bitcoin or DASH, with builds distributed through a buyer portal; despite its Tor-focused design, Sphinx reportedly retained a ZeuS-like PHP web panel and encrypted HTTP communications for botnet command and control.