A new spear-phishing campaign targeting Brazil has been found delivering a banking malware called Astaroth (aka Guildma) by using obfuscated JavaScript to slip past security defenses. The campaign's impact has targeted various industries, with manufacturing companies, retail firms, and government agencies being the most affected. Malicious emails often impersonate official tax documents, using the urgency of personal income tax filings to trick users into downloading the malware.
See: https://redskyalliance.org/xindustry/ghimob-brazil
The cybersecurity researchers are tracking the threat activity cluster called Water Makara. It's worth pointing out that Google's Threat Analysis Group (TAG) has assigned PINEAPPLE to a similar intrusion set that delivers the same malware to Brazilian users. Both these campaigns share a point of commonality in that they commence with phishing messages that impersonate official entities such as Receita Federal and aim to trick recipients into downloading a ZIP archive attachment that masquerades as income tax documents.[1]
Inside the harmful ZIP file is a Windows shortcut (LNK) that abuses mshta.exe, a legitimate utility meant to run HTML Application files, execute obfuscated JavaScript commands, and establish connections to a command-and-control (C2) server. "While Astaroth might seem like an old banking trojan, its reemergence and continued evolution make it a persistent threat," the researchers said. "Beyond stolen data, its impact extends to long-term damage to consumer trust, regulatory fines, and increased costs from business disruption and downtime as well as recovery and remediation."
To mitigate the risk posed by such attacks, it is recommended to enforce strong password policies, use multi-factor authentication (MFA), keep security solutions and software updated, and apply the Principle of Least Privilege (PoLP).
This article is shared at no charge and is for educational and informational purposes only.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. We provide indicators of compromise information via a notification service (RedXray) or an analysis service (CTAC). For questions, comments, or assistance, please get in touch with the office directly at 1-844-492-7225 or feedback@redskyalliance.com
- Reporting: https://www.redskyalliance.org/
- Website: https://www.redskyalliance.com/
- LinkedIn: https://www.linkedin.com/company/64265941
REDSHORTS - Weekly Cyber Intelligence Briefings
https://register.gotowebinar.com/register/5378972949933166424
[1] https://thehackernews.com/2024/10/astaroth-banking-malware-resurfaces-in.html
Comments