Astaroth

Astaroth, a malicious software (malware), has been identified as a significant threat due to its highly developed evasive skills and information stealing capabilities. This malware infects systems through suspicious downloads, emails, or websites, often without the user's knowledge. Once inside, it can steal personal information, disrupt operations, or hold data hostage for ransom. The Astaroth Trojan campaign specifically targets Avast's aswrundll.exe process and uses an external feature, NetPass, for additional information theft. In previous versions of this campaign, cerutil was used to download files, indicating a possible evolution in the malware's methodology. Cybersecurity researchers have issued warnings about a surge in email phishing campaigns using Google Cloud Run service to deliver banking trojans like Astaroth, Mekotio, and Ousaban. These attacks have targeted victims across Latin America and Europe since September 2023. More than 300 financial organizations have already fallen victim to the Astaroth trojan, also known as Guildma. Notably, Mekotio, delivered in the later stages of Astaroth attacks, permits browser manipulation and theft of banking credentials and personal data. The misuse of Google Cloud Run in these high-volume malware distribution campaigns is particularly concerning. The latest variant of Astaroth has targeted over 300 institutions across 15 Latin American countries, making it one of the most widespread malware campaigns in recent history. Some of the highest volume campaigns were observed delivering Astaroth, Mekotio, and Ousaban banking trojans, primarily to victims located in Latin America. The scale and sophistication of these attacks underscore the evolving threat landscape and the need for increased vigilance in cybersecurity measures.