Cybersecurity report

# Gameover Zeus re-emerges without peer-to-peer capability

Sophos, July 10, 2014. Gameover Zeus resurgence after Operation Tovar: a new variant observed at approximately 10:00 am EDT on 10 July 2014 in Cutwail-sent spam, which dropped the peer-to-peer component in favour of centralised command and control with a previously unseen domain generation algorithm.

**Source type:** Cybersecurity report

**Published:** July 10, 2014

**Research grade:** T2

**Used in entries:** 1

## Bibliographic record

**Publisher:** Sophos

**Published:** July 10, 2014

**Source type:** Cybersecurity report

**Research grade:** Source grade T2

**Language:** English

**Official record:** Not an official publication

**Address:** [https://www.sophos.com/en-us/blog/gameover-zeus-re-emerges-without-peer-to-peer-capability](https://www.sophos.com/en-us/blog/gameover-zeus-re-emerges-without-peer-to-peer-capability)

**What it supports:** Gameover Zeus resurgence after Operation Tovar: a new variant observed at approximately 10:00 am EDT on 10 July 2014 in Cutwail-sent spam, which dropped the peer-to-peer component in favour of centralised command and control with a previously unseen domain generation algorithm

**Dataset id:** src\_sophos\_ctu\_gameover\_zeus\_2014

## Research notes

- Authored by the Counter Threat Unit Research Team. The research originates with Secureworks and is now hosted on the Sophos blog following Sophos's acquisition of Secureworks.
- Distinct from the existing record src\_secureworks\_gameover\_2014, which is a different article ('Operation Tovar: Efforts Targeting Gameover Zeus & CryptoLocker') on secureworks.com.
- The publication date and the date of first observation reported in the article are the same day, 10 July 2014.

How this source is used

Cited 1 time across 1 record type.

The role on each citation records what the source was relied on for. A primary source establishes the fact, a supporting source corroborates it, technical evidence describes the infrastructure, and a later outcome records what happened afterwards.

Sources were reviewed to a research cutoff of August 23, 2026. Addresses recorded after that date are not reflected here.

## Cited by

### Later activity

1 citation

Cited for activity recorded after the takedown.

-
[Gameover Zeus DGA variant](https://takedownindex.org/takedowns/operation-tovar)

Same service on replacement infrastructure, Operation Tovar

Technical evidence

[All sources](https://takedownindex.org/sources)