Malevolent Astaroth Banking Malware Emerges Again in Brazil Through Targeted Spear-Phishing Attack
A fresh spear-phishing operation aimed at Brazil has surfaced that sends out a banking malicious software known as Astaroth (also referred to as Guildma) by using obscured JavaScript to bypass security protocols.
“The reach of the spear-phishing assault has affected various sectors, with manufacturing businesses, retail companies, and governmental institutions experiencing the most impact,” Trend Micro stated in a recent examination.
“The deceitful emails commonly pose as legitimate tax documents, exploiting the immediacy of personal income tax filings to deceive users into downloading the malware.”
The cybersecurity corporation is monitoring the menace phenomenon cluster under the title Water Makara. It’s important to note that Google’s Threat Analysis Group (TAG) has dubbed the group PINEAPPLE, which operates in a similar manner by transmitting the same malicious software to users in Brazil.
Both of these campaigns share a common approach in that they kick off with phishing communications impersonating authoritative bodies like Receita Federal and aiming to deceive recipients into fetching a ZIP bundle attachment disguised as income tax paperwork.
In the malicious ZIP file lies a Windows shortcut (LNK) that misuses mshta.exe, a legitimate tool designed to execute HTML Application files, implement veiled JavaScript directives, and establish links to a command-and-control (C2) server.
“Despite the age of Astaroth, this banking trojan’s resurgence and continuous evolution render it a persistent menace,” the researchers remarked.
“Beside data pilferage, its repercussions encompass enduring harm to consumer trust, fiscal penalties, escalated expenses due to business interruptions and downtime, in addition to the costs of recuperation and correction.”
To reduce the vulnerability to such assaults, it is advised to institute stringent password regulations, leverage multi-factor authentication (MFA), maintain up-to-date security solutions and software, and adopt the principle of least privilege (PoLP).
About Author
