Ankura CTIX FLASH Update - February 27, 2024

Malware Activity

Banking Trojans are on the Rise Targeting Latin America and Europe

Cybersecurity researchers have observed an uptick in email phishing campaigns designed to deliver banking trojans to victims primarily in Latin America and Europe. Three (3) trojans in particular: Astaroth (Guildma), Mekotio, and Ousaban (Javali) are misusing Google's Cloud Run service to distribute the malware. Google Cloud Run is a managed computing platform that enables customers to build and deploy webservices in Google Cloud. Threat actors are weaponizing Google Cloud Run due to its trusted nature; many organizations will not prevent internal systems from accessing Google platforms. Cybersecurity researchers have been tracking the rise of these phishing campaigns since the Fall of 2023. There are many commonalities between the malware families which all use the same storage bucket in Google Cloud for propagation and malicious Microsoft Installers (MSIs) as droppers for the