Citadel

Overview
A Zeus variant that first appeared in 2012, the sale and use of Citadel is limited to select groups of cybercriminals and run as-a-service. Several Member States continue to report low numbers of Citadel cases. In April 2016, a new variant of Citadel, dubbed Atmos, began targeting financial institutions in France. The Trojan is noted as having C&C servers based in Vietnam, Canada, Ukraine, Russia, the US and Turkey. It is unknown how many of the law enforcement reports reflect the appearance of this new variant.