ZeuS botnet toolkit is being sold on online forums

The source code for the infamous ZeuS toolkit is being offered by some cyber criminal through the underground forums on the Internet.

Nicknamed IOO the supposed seller provided proof of having the code by placing some screenshots of the source code portions. The sale is offered to be discussed vie either ICQ or Jabber. Any escrow payment is accepted.

The screenshots make reference to peinfector.cpp, a project of ZeuS known as "Murofet". While security researchers cannot verify if the sale is genuine they are taking the potential offer seriously.

"Prior to this there were several rumors that the Zeus/Zbot code was sold to the creator of SpyEye," writes Peter Kruse, an eCrime specialist who works for Danish security consultancy CSIS Security.

"This is also currently unconfirmed - however what is certain is the fact that someone besides the author of the ZeuS/Zbot has access to the code."

Whether the specific sale by IOO is genuine or not, Kruse is sure that the secret recipe of ZeuS has become accessible to more people over recent weeks. "We have also seen compile logs confirming that ZeuS/Zbot code is available to broader audiences," he told.