Zapret 2 GUI: Analysis of Spyware and Privacy Threats

Zapret 2 GUI: A Privacy Threat and Cyber Espionage Disguised as DPI Bypass

Amidst tightening internet censorship and the throttling of popular services like YouTube and Discord in Russia, the demand for Deep Packet Inspection (DPI) bypass tools has surged. The original zapret project by @bol-van offers an effective command-line solution, but its complexity for the average user led to the emergence of numerous GUI wrappers. Unfortunately, the promise of ease of use can often conceal serious security threats. In this article, we conduct a detailed analysis of the "Zapret 2 GUI" fork (by author censorliber), which, despite its popularity on GitHub, has been identified as a full-fledged spyware tool capable of compromising user systems.

Context and Alarming Signals

The proliferation of DPI systems in recent years has spurred the development of solutions to circumvent blocking. zapret established itself as a reliable, albeit technically complex, tool. This opened a niche for projects offering user-friendly graphical interfaces. However, it is precisely these "simplified" versions that often become vectors for attacks. The investigation into "Zapret 2 GUI" was initiated after suspicious activity was detected on a computer, leading to in-depth reverse engineering of the source code on GitHub and dynamic analysis of the distributed binary builds. The analysis results indicate the presence of functionality characteristic of Trojan-Downloaders and Spyware. Attempts by the researcher to raise this issue in the project's repository were met with an aggressive reaction and claims of "secrets in the private part of the code," which only reinforced the need for public disclosure of the identified threats.

Destructive Actions and System Compromise

Analysis of the "Zapret 2 GUI" source code revealed several functions unrelated to the stated goal of DPI bypass and posing a direct threat to user system security.

Disabling System Protection

The file altmenu/defender_manager.py contains functionality that deliberately disables Windows Defender by modifying the system registry. While developers might justify this as "convenience" to prevent antivirus interference, completely disabling built-in protection leaves the system extremely vulnerable. This opens the door for any subsequent malicious activities, allowing attackers to exploit vulnerabilities or install other malware unimpeded.

Covert Root CA Installation

One of the most critical aspects is the functionality implemented in the startup/certificate_installer.py file. The program covertly installs a third-party certificate into the operating system's "Trusted Root Certification Authorities" store. Installing a root certificate is completely unnecessary for DPI bypass. Its presence is only required for decrypting HTTPS traffic. By installing its own Root CA, an attacker gains the ability to perform Man-in-the-Middle (MitM) attacks. This allows them to intercept and decrypt all protected user traffic, including communications, authentication data (cookie sessions, passwords), and other confidential information transmitted over HTTPS. Thus, user traffic ceases to be private and becomes accessible for monitoring and data collection.

Espionage and Data Exfiltration

Beyond compromising protection and traffic, "Zapret 2 GUI" actively engages in collecting and exfiltrating user data. The scripts tgram/tg_log_delta.py and tg_log_full.py are configured for regular system information collection. Every 30 minutes, they gather the computer name, operating system version, and system Unique ID (UUID). This data is then sent to the project administrator's private Telegram chat using encrypted bot tokens. This process is a clear sign of spyware activity, as the collected information can be used to identify users, track their activity, and launch further targeted attacks.

Discrepancies Between Source Code and Binary Builds

Serious concerns arise from the discrepancy between the code available in the public GitHub repository and the compiled executable files (EXEs) distributed via the project's Telegram channel. The developers themselves admit that the code on GitHub is "two months behind the actual code." This is a classic tactic for concealing malicious functionality (payload), where "clean" code is publicly displayed, while the distributed binaries contain additional, hidden capabilities.

Reports from reputable sandboxes like ANY.RUN and Tria.ge confirm the malicious nature of the builds. The verdict "Malicious (Loader / Spyware)" unequivocally indicates the presence of malware. Attempts to inject code into memory have been observed, which is characteristic behavior for sophisticated malware aiming to evade detection and establish persistence in the system.

Ethical and License Violations

The "Zapret 2 GUI" project positions itself as a fork but grossly violates the terms of the MIT license. The fork's author removed the name of the original core developer (@bol-van) and replaced it with their own nickname. This is a direct violation of the license requirements, which stipulate the preservation of copyright notices and permissions. Furthermore, a system of paid "premium subscriptions" was built on top of the free and open-source winws.exe core. Selling paid services for software that simultaneously engages in espionage and compromises user data is the height of cynicism and fraud.

Developer Reaction and Consequences

When attempts were made to discuss the identified issues on GitHub and in the Telegram channel, the "Zapret 2 GUI" developers failed to provide any technically sound response regarding the Root CA installation or other suspicious functions. Instead, they resorted to gaslighting tactics, accusing the researcher of using "AI-generated text" and appealing to "convenience for housewives." Most tellingly, they claimed to have "secrets" in a private repository. For an Open Source project claiming trustworthiness, the presence of hidden code sections, especially given the identified malicious functionality, is unacceptable and unequivocally points to bad faith.

Following the public analysis, GitHub Trust & Safety initiated their own investigation. Interestingly, after the discussion began, the developers rewrote 90% of the code within a week, removing precisely the modules highlighted by the analysis. This indirectly confirms the validity of all accusations made and demonstrates an attempt to cover up traces of malicious activity.

Key Takeaways

• "Zapret 2 GUI" is not a safe DPI bypass tool; it is Spyware and a Trojan-Downloader.
• The program disables Windows Defender and covertly installs a third-party Root CA, allowing HTTPS traffic interception.
• It collects and exfiltrates system data (PC name, OS, UUID) to the administrator's Telegram chat.
• Distributed binary builds contain malicious functionality absent from the public repository.
• The project violates the MIT license and monetizes malware through "premium subscriptions."

Mitigation Steps

If you have installed and run "Zapret 2 GUI," it is strongly recommended that you take the following steps to protect your system and data:

• Uninstall the program: Completely remove "Zapret 2 GUI" and all associated components from your system.
• Check certificates: Open certmgr.msc (via Win + R) and thoroughly check the "Trusted Root Certification Authorities" section for any suspicious or unknown certificates. Remove them.
• Restore Hosts file: Check your C:\Windows\System32\drivers\etc\hosts file for unauthorized changes. Ensure it does not contain unnecessary IP addresses and does not have extended write permissions for all users (Everyone:F). If necessary, restore its default content.
• Change passwords: Immediately change passwords for all critical online services, especially those you used after installing "Zapret 2 GUI" (email, banking apps, social media).
• Full antivirus scan: Perform a full system scan with reliable antivirus software.

Free software with a polished interface often harbors hidden risks. Always critically evaluate programs that require elevated privileges, and only trust verified sources. Protect your digital identity and data.

— Editorial Team