A new wave of Astaroth Trojan malware has resurfaced in South America, with more than 8,000 machines attacked in just one week.

According to the Cofense Phishing Defense Center, the Trojan used fake invoice emails with .lnk attachments that appeared to come from legitimate services under cam.br domains. It specifically targeted South American businesses — any attacks that detected an IP address outside of this geographic area were aborted.

If South American targets clicked on the provided link, Astaroth — the “Great Duke of Hell” in ancient lore — leveraged the Windows Management Instrumentation Console (WMIC) and its connected command-line interface to download nonlocal payloads with .xsl extensions.

Because the WMIC was run in noninteractive mode, users were typically unaware of the compromise. The malware then prevented users from opening any web browser except Internet Explorer, and when users navigated to Brazilian banks or businesses, it began recording keystrokes for data collection and account compromise.

How Does Astaroth Avoid Detection?

Astaroth first emerged in 2017, but Cofense noted that the revived campaign “has been well planned and supported, exclusively targeting South Americans.”

Despite its limited radius, however, the Trojan malware presents real concerns for organizations. To evade detection, the malware uses a randomly selected domain from a list of 154 in-code options. All the domains were hosted on Cloudflare, making it difficult to immediately identify them as malicious. This also made it hard for companies to effectively block Astaroth payloads due to the sheer number of legitimate domains associated with Cloudflare.

Furthermore, given the utility of the WMIC in managing Windows hosts, it remains a popular tool for corporate administrators — making it the ideal vehicle for Astaroth. It also makes it difficult for companies to avoid infection, since the WMIC is often a key part of day-to-day operations.

How to Protect Your Organization From Trojan Malware

To avoid Astaroth, IBM X-Force Exchange recommends implementing a separate verification process for email attachments. This could take the form of texts, phone calls or other secure communications. If users can easily verify that unexpected emails were not sent by legitimate vendors or clients, they can delete them instead of potentially exposing systems to risk.

Security professionals also suggest using continuous backup solutions coupled with regular account monitoring to limit the impact of data-stealing Trojan malware and prevent keyloggers from stealing password and login data.

Source: Cofense Phishing Defense Center