Business Club
Business Club is a Russian-speaking cybercriminal group that referred to itself internally as the "Business Club." Reporting cited in the content links it to the Gameover ZeuS ecosystem and to large-scale bank fraud using Evgeniy Mikhailovich Bogachev’s ZeuS banking trojan. The group is described as having a core of about six members supported by more than 50 additional individuals, operating as a structured criminal enterprise with specialized roles including technical support, malware supply, and money mule recruitment, with membership involving an initial fee and profit-sharing. Key leaders, including Bogachev, were reportedly based in or around Krasnodar, Russia, and members were spread across much of Russia’s time zones, enabling fraud operations across multiple regions during local business hours. The content states that the JabberZeuS Crew and the Business Club collectively stole more than $200 million from U.S. and U.K. financial institutions using ZeuS. Business Club operators used the Gameover ZeuS control panel, which they called the "World Bank Center," to intercept banking security challenges such as one-time tokens and secret questions. The group also used fraudulent wire transfers from hacked U.S. and European accounts to Chinese front companies near the Russia-China border, including in Heilongjiang province, and established phony trading and shipping companies in places such as Raohe county and Suifenhe to receive funds. The content also notes that attacks involving Dyre could be connected to the Business Club cybercriminal group. In addition, Fox-IT reporting described in the content found that Bogachev did not share the entire botnet with other Business Club members and secretly repurposed part of it for espionage against targets in Ukraine, Turkey, and Georgia; however, that espionage activity is described as managed by Bogachev himself and hidden from at least some other Business Club members. Known alias in the provided content: business_club.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Banks
Where they target
Geographies tied to known operations.
- 🇺🇸 United States
- 🇬🇧 United Kingdom
Tradecraft
7 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
1 malware family attributed to this actor across reporting.
Observables
15 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Cybercrime ring that stole from U.S. and U.K. financial institutions using the ZeuS banking trojan.
An Eastern European organized cybercrime group that operated the Gameover ZeuS ecosystem for large-scale bank fraud, online extortion, spam, and money-laundering operations, including use of Chinese front companies near the Russia-China border to cash out stolen funds.
Cybercriminal group referenced in historical context around Dyre/Zeus-era banking malware operations; mentioned as potentially connected to some Dyre attacks and broader ecosystem evolution.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.