News report

# Citadel Banking Trojan Returns as 'Atmos'

Infosecurity Magazine, April 11, 2016. Citadel successor: Heimdal Security's identification of Atmos as a Citadel variant, observed targeting French banks and distributed alongside TeslaCrypt ransomware.

**Source type:** News report

**Published:** April 11, 2016

**Research grade:** S2

**Used in entries:** 1

## Bibliographic record

**Publisher:** Infosecurity Magazine

**Published:** April 11, 2016

**Source type:** News report

**Research grade:** Source grade S2

**Language:** English

**Official record:** Not an official publication

**Address:** [https://www.infosecurity-magazine.com/news/citadel-banking-returns-as-atmos/](https://www.infosecurity-magazine.com/news/citadel-banking-returns-as-atmos/)

**What it supports:** Citadel successor: Heimdal Security's identification of Atmos as a Citadel variant, observed targeting French banks and distributed alongside TeslaCrypt ransomware

**Dataset id:** src\_infosecurity\_citadel\_atmos\_2016

## Research notes

- By Tara Seals.
- published\_on taken from the page's schema.org datePublished (2016-04-11T19:55:00+00:00); the page was last modified 2025-05-25.

How this source is used

Cited 1 time across 1 record type.

The role on each citation records what the source was relied on for. A primary source establishes the fact, a supporting source corroborates it, technical evidence describes the infrastructure, and a later outcome records what happened afterwards.

Sources were reviewed to a research cutoff of August 23, 2026. Addresses recorded after that date are not reflected here.

## Cited by

### Later activity

1 citation

Cited for activity recorded after the takedown.

-
[Atmos (Citadel-derived banking trojan)](https://takedownindex.org/takedowns/citadel-botnet-disruption)

Ecosystem successor, Citadel botnet disruption

Later outcome

[All sources](https://takedownindex.org/sources)