Zeus uses HTTP with custom headers:
While the original toolkit is old news, its DNA lives on in modern banking trojans. For blue teamers and analysts, understanding Zeus is essential to understanding the evolution of modern threats. zeus toolkit