Z is for Zeus — The Grandfather, Still Free

The Alphabet of Actors — Letter Z, the last. A named-entity dossier: who they are in the record, what the LSN systems catch of their kind today, and a status verdict — ACTIVE, DEFUNCT, REBRANDED, PROSECUTED, ABSORBED, INDICTED, DISBANDED, EXPOSED, DISSOLVED, UNDETERRED, NORMALIZED, SANCTIONED, CAUGHT, EVOLVING, TAKEN DOWN, IMMORTAL, LIABLE, UNMASKED, NAMED, UNINSTALLED, ARRESTED, WEAPONIZED, DECAPITATED, BURROWED, PRE-POSITIONED, INCORPORATED, LETHAL, OUTED, ANCESTRAL.

Twenty-five letters have carried the register forward through the state destroyers and the espionage services, the spyware vendors and the ransomware corporations, the botnet the honeypot watches every day and the malware built to kill. The alphabet has to end somewhere, and it ends where so much of it began — with the grandfather. Zeus was the banking trojan that taught the criminal world how to steal money at scale, the template from which a huge share of the financial malware in every other letter descends. And its creator, a Russian man named Evgeniy Bogachev, is the register's final and most fitting subject, because he closes the alphabet on the note it has struck more than any other: a person who did immense harm, whose name and face and crimes are all documented, who carries the largest bounty the United States ever placed on a cybercriminal — and who is, as these words are written, a free man, living openly by the Black Sea, beyond the reach of everyone who wants him.

There is a reason to end the alphabet here rather than on a louder actor, and it is that Zeus and Bogachev are a synthesis. Nearly every thread the register has been pulling for twenty-five letters runs through this one man: the leaked source code that becomes an immortal genus; the named individual charged but forever unreachable; the takedown that dismantles the machine and never touches the operator; the birth of the ransomware that a quarter of the alphabet is about; and, beneath it all, the fusion of the criminal and the state that has haunted every letter that tried to draw a line between them. Bogachev is all of those at once. He is the crime boss and the intelligence asset, the innovator and the fugitive, the origin and the unpunished. The last letter is not the biggest actor. It is the one in whom the whole story converges.

This is the letter about where it started, about a man who served two masters and got away with both, and about what an entire alphabet of actors finally adds up to.

1. The Origin: the malware that taught crime to scale

To understand why Zeus deserves the final letter you have to understand that it was not just a successful piece of malware but a founding one — the tool that turned online bank robbery from a bespoke craft into an industry. Appearing around 2007, Zeus was a banking trojan, built to do one thing supremely well: sit silently on a victim's computer and steal the credentials to their online bank. It grabbed what people typed into login forms, logged their keystrokes, and injected fake fields into real banking websites to harvest the extra details a thief would need. And crucially, it was packaged — sold and shared as a kit, a product, so that a criminal did not need to be a brilliant programmer to run a banking-theft operation. They needed to acquire Zeus, and Zeus did the hard part.

That productization is the founding act, and it is why the register ends on it. Before tools like Zeus, serious financial cybercrime required serious skill; Zeus lowered the barrier, and in doing so it did not just commit crimes — it manufactured criminals, letting a whole population of people who could never have written such a thing nonetheless operate it. The design choices Zeus made — the form-grabbing, the web-injects, the modular kit sold to affiliates — became the standard grammar of financial malware, the assumptions every later banking trojan started from. When the register profiled the loaders and the banking trojans and the crimeware kits of later years, it was profiling Zeus's descendants, working in the idiom Zeus established. The grandfather does not have to be the most powerful actor in the family. It only has to be the one everyone else came from, and Zeus is that.

So the alphabet closes with a bookend. The register opened, letters ago, on the actors of the present — the pre-positioners and the safety-system killers and the corporations of crime — and it closes on the actor of the origin, the modest-looking banking trojan from the late 2000s whose real significance is everything that grew out of it. To end on Zeus is to end on the first cause, which is the honest place for an alphabet of actors to stop: not at the loudest note, but at the root.

2. The Leak: how the grandfather became immortal

The single event that turned Zeus from a successful operation into an eternal one happened in 2011, and it is a pattern this register has already named, which is part of why Zeus belongs at the end: it did first, and for money, what a later letter made famous. In 2011, the Zeus source code leaked publicly. The blueprint of the most effective banking trojan in the world was suddenly available to anyone, and the consequence was proliferation. The leaked code was taken, studied, forked, and rebuilt into a lineage of derivatives — Citadel, ICE IX, Gameover Zeus, and a long tail of others — each one inheriting Zeus's design and adding to it. One operation's tool became an entire genus's foundation.

Readers of this register will recognize the shape exactly, because letter M made it the center of its argument. Mirai's authors published their botnet's source code and turned a single operation into a permanent family that no takedown could ever fully kill, because you cannot un-publish code. Zeus did the same thing, five years earlier, in the world of financial crime. The 2011 leak meant that killing Zeus itself, whenever it finally happened, would accomplish nothing, because Zeus no longer needed to exist for its descendants to thrive. The genus had escaped the ancestor. This is the proliferation-by-publication pattern in its original financial form, and putting it at the end of the alphabet, after the reader has already met it at Mirai, reframes it as a rule rather than an incident: published code becomes immortal, and the most consequential thing a piece of malware can do is not what it steals but what it spawns.

There is a grim symmetry in the two leaks bracketing the register. Mirai, near the middle of the alphabet, was the leaked-source genus of the machines — the IoT devices, the botnet floor the honeypot watches. Zeus, at the end, is the leaked-source genus of the money — the banking trojans, the financial-crime economy. Between them they define the two great immortal lineages of commodity cybercrime, and both became immortal the same way: someone published the code, and after that, no one could ever take it back.

3. The Fusion: one man, two masters

The fact that lifts Bogachev above an ordinary crime boss, and makes him the perfect actor to close an alphabet that has spent twenty-five letters struggling to separate crime from statecraft, is that he appears to have been both at once. This is the letter's darkest and most resonant finding, so it must be stated with care as the assessment it is.

Bogachev's masterpiece was Gameover Zeus, a version of his creation built as a resilient peer-to-peer botnet, engineered to survive the takedown attempts that killed simpler botnets. He used it to do what a criminal uses a botnet for: to steal from bank accounts on an enormous scale, and to distribute CryptoLocker, one of the first mass crypto-ransomware families and, as the next section notes, a genuine progenitor of the entire ransomware era. That is the crime. But according to FBI officials and independent researchers — most notably the analysts at Fox-IT who studied what the botnet was actually being told to look for — Gameover Zeus was also, quietly, doing something else. Woven into its criminal tasking were searches of infected machines in specific countries — Georgia, Ukraine, Turkey, Syria — for military and intelligence keywords: the sort of collection that is worthless to a bank thief and priceless to a state.

Sit with what that means, because it is the synthesis the whole register has been building toward. The same botnet, at the same time, was robbing people for Bogachev's profit and spying on people for someone's — the assessment is Russia's — intelligence benefit. Bogachev was not a criminal who occasionally helped the state, or a state operator who moonlighted as a criminal. He was, on the evidence, both simultaneously, running one machine that served two purposes, and this is almost certainly why he has never been surrendered: a man who does the state's intelligence work is not a man the state extradites, whatever his crimes against the rest of the world. Every letter in this alphabet that tried to sort actors into "criminal" and "state-sponsored" ran into cases where the categories blurred — the ransomware crew the Kremlin tolerates, the state that funds itself by theft, the research institute that builds a weapon. Bogachev is where the blur becomes total. He is the single actor in whom crime and statecraft are not adjacent but identical, and that identity is his armor.

4. The Ransom, and the Reach That Failed

Before the register draws its final lesson from Bogachev's freedom, two more facts complete the portrait, and both point forward into everything the alphabet documented after him. The first is CryptoLocker. When Gameover Zeus distributed CryptoLocker around 2013, it helped prove a business model that would come to define the decade: encrypt a victim's files, demand payment in cryptocurrency for the key, and repeat at scale. CryptoLocker was not the first ransomware ever, but it was one of the first to make crypto-ransomware a mass, professional, profitable enterprise — and the ransomware era it helped inaugurate is the subject of a full quarter of this alphabet: the brands at letter L, the loaders at Q, the supply-chain extortion at R, the criminal corporation at W. Bogachev did not just help found financial malware; through CryptoLocker he stands near the headwaters of ransomware too. The grandfather's reach into the present is longer than a single genus.

The second fact is the reckoning, and it is the register's oldest finding delivered one last time. In June 2014, a genuinely impressive multi-national effort called Operation Tovar dismantled the Gameover Zeus botnet and disrupted CryptoLocker, freeing infected machines and recovering the means to decrypt victims' files. It was a real operational victory, of exactly the kind the register credited at QakBot and at the Snake takedown — the infrastructure was struck, the victims were helped, the machine was broken. And the United States indicted Bogachev by name, and in 2015 the FBI announced a reward of up to three million dollars for information leading to his arrest or conviction, the largest bounty it had ever offered for a cybercriminal, and in 2016 the Treasury sanctioned him. Every instrument of consequence the system possesses was aimed at this one man: a takedown, an indictment, a record reward, a sanction.

And none of it reached him. Bogachev lives, by all accounts, openly in Russia — in the Black Sea resort town of Anapa, owning property, reportedly fond of boats, a free man in comfortable circumstances, beyond any extradition. The botnet died; the operator did not. The register has said this many times, about many actors, but it says it with special force here at the end, because Bogachev is the purest case: not an anonymous cluster, not a group behind a codename, but a specific human being whose guilt the United States considers so clear that it will pay three million dollars to anyone who can deliver him, and who nonetheless wakes up every morning entirely safe, because the country he did intelligence work for will never hand him over. This is the final statement of the alphabet's most persistent theme. Consequence, in this domain, lands on the reachable and stops at the border of a state that finds the criminal useful. Bogachev is standing, comfortably, on the far side of that border, and he has been standing there for a decade.

5. The counter-narrative, steelmanned

The strongest objections to closing the register on Zeus concern currency and sourcing, and both deserve a fair final hearing.

The argument runs like this. Zeus is old — a banking trojan from the late 2000s, its botnet dismantled in 2014, its creator a decade into a comfortable retirement; ending an alphabet meant to illuminate today's threats on a historical figure risks nostalgia over relevance, especially when the register's own later letters (the pre-positioners, the safety-system attackers) are the actually-current dangers. And the sourcing, as with the previous letter, is thinner than the register's strongest entries: the account rests on the public record — the FBI's wanted notice, the DOJ's Operation Tovar announcement, journalists' and researchers' reconstructions of the espionage tasking — rather than on the deep primary material behind, say, the TRITON or SolarWinds letters. The espionage-fusion claim in particular, however well-reported, is an assessment built on inference about what a botnet was searching for, not an adjudicated fact. Closing on it, the argument concludes, ends the register on a lower evidentiary tier than it deserves.

The dossier grants the sourcing point plainly and defends the choice of ending. On sourcing: this letter states, here and in its footer, that it rests on the public record and that the charges against Bogachev are charges, not a conviction — he is untried, the presumption of innocence formally applies to the named man, and the espionage-tasking is a strongly-supported assessment rather than a proven fact. That transparency is the honest handling of a well-reported but not locally-documented case, and it is the same standard the register applied at the previous letter. On currency: the objection mistakes the purpose of a final letter. The register does not end on Zeus because Zeus is the most current threat; it ends on Zeus because Zeus is the origin and the synthesis, the actor in whom the alphabet's threads converge, and a story that has run from A to Y earns the right to close on its root rather than its latest branch. And the deeper answer is that Bogachev is not, in the way that matters, historical at all: his genus still steals, the ransomware model CryptoLocker helped prove still runs the world, the crime-state fusion he embodied is more entrenched than ever, and the man himself is not a closed case but an open one — a fugitive still at large, a bounty still unclaimed, a consequence still un-delivered. The counter-narrative is right that Zeus is old and the sourcing lighter, and the letter concedes both. It is wrong that ending on the origin is nostalgia, because the origin never went away.

6. Verdict — ANCESTRAL, and UNCAUGHT

Zeus is the letter of the root — the banking trojan that taught crime to scale, whose leaked code seeded a genus that no takedown could recall, whose creator built a botnet that robbed the world and spied for a state at the same time, and who stands today, indicted and sanctioned and worth three million dollars to whoever can catch him, a free man by the Black Sea. It is the origin of so much of what the register profiled, and it is the purest instance of the register's hardest truth. The alphabet ends where it should: at the first cause, and at the one who got away.

The verdict's first word is what Zeus is to everything that followed: ANCESTRAL. Not the most powerful actor, not the most current — the ancestor, the template, the grandfather whose design became the grammar of financial malware and whose leaked source became an immortal lineage. To trace the genealogy of a huge share of the actors in this register is to arrive, eventually, at Zeus, which is why the last letter is not a new threat but an old origin. The genus outlives the ancestor, and the ancestor is at Z.

The second word is the register's oldest finding in its starkest form: UNCAUGHT. Every tool the system has was aimed at Bogachev — a takedown, an indictment, a record bounty, a sanction — and he was never reached, because he did the work of a state that will not surrender him. Not exposed-but-active, not sanctioned-but-undeterred, not arrested-then-abandoned. Simply uncaught: named, wanted, worth a fortune, and free, for a decade and counting. In an alphabet that kept finding that consequence stops at a hostile border, Bogachev is the man standing comfortably on the far side of it, and the three-million-dollar reward is a measure of exactly how badly, and how vainly, the reachable world wants him back.

And here the alphabet ends.

Twenty-six letters, twenty-six actors — the destroyers and the spies, the vendors and the crews, the corporations and the lone convicted men, the botnet the honeypot watches being born every day and the malware built to switch off the safeguard that keeps a plant from killing its workers. Laid end to end, they do not tell a comforting story. They tell, again and again, the same few truths. That published code becomes immortal, so the most dangerous thing an actor can do is spawn a genus rather than run an operation. That exposure is not consequence — that you can name a company, indict a man, sanction a service, dismantle a botnet, and still not stop the thing you exposed, because the code stays published, the model stays teachable, the workforce splinters, and the operator sits behind a border that finds him useful. That the line between crime and statecraft, which the whole register kept trying to draw, does not hold — that the ransomware crew and the intelligence service and the research institute and the fugitive by the sea all bleed into one another, and that the bleeding is deliberate, because deniability is the point. And that the harm, in the end, is always human: the patient whose surgery was cancelled, the dissident whose phone was read, the worker at the plant, the citizen in the winter blackout, the small business drained by a trojan a thousand people downstream of Zeus.

The honeypot beneath these words cannot see most of what the alphabet describes. It cannot see the safety controller or the satellite downlink or the vishing call or the pre-positioned foothold in the water utility. What it sees is the floor: the endless, patient, commodity pressure of the internet's weakest doors being tried, all day, forever — the credential brute-forcing and the botnet recruitment and the leaked-exploit reuse that are the descendants and the raw material of nearly everything in these twenty-six letters. That floor is not separate from the ceiling. It is the same building. The register's whole argument is that the loud commodity noise the honeypot measures and the silent apex threats it never sees are made of the same materials, drawn from the same pools, running on the same insecure devices and the same fallible people — and that watching the floor honestly is how you learn the shape of the whole structure.

That is what the vectors are for. They do not lie: the target was real, the technique was real, the harm was real, the consequence was real or, more often, really absent. And they do not judge — a vector is only a fact, a record of what was done, stripped of the comfort of a verdict. The judging is not the register's job and never was. It laid out what happened, as exactly as the evidence allowed, kept the bright line between what was proven and what was only assessed, centered the people who were hurt, and steelmanned the case for the other side before answering it. What it asked of the reader, at the end of every letter and now at the end of them all, is the only thing a forensic register can honestly ask: look at the vectors, which do not lie, and judge for yourself.

The Alphabet of Actors is complete. The grandfather is still free. The genus he founded is still stealing. And somewhere, right now, the honeypot's telnet port is being tried again — by one of his descendants, or one of Mirai's, or something newer that will earn its own letter someday. The alphabet ends. The work does not.

The Alphabet of Actors — concluded at Z. Verdict: ANCESTRAL, and UNCAUGHT. Confidence: MEDIUM-to-HIGH, sourcing stated plainly — the account rests on the public record (the FBI Cyber Most Wanted notice and $3M reward, the DOJ's Operation Tovar and the Bogachev indictment, the US Treasury sanction, and the FBI/Fox-IT assessment of Gameover Zeus's espionage tasking) rather than deep local-archive material; the charges against Bogachev are charges, not a conviction, he is untried, and the presumption of innocence formally applies; the espionage-fusion is a strongly-supported assessment. Victims of Zeus and CryptoLocker are centered as the harm. Classification: TLP:WHITE. Include everything — the vectors do not lie, and they do not judge. The reader judges the grandfather of the genus, the man who served two masters, and the whole alphabet that led here.