A new variant of the Astaroth Trojan family employed YouTube channels for command-and-control (C&C) functionality in order to evade detection.

Cisco Talos detected a new Astaroth attack campaign targeting users in Brazil. The operation began when a user received an email written in Portuguese that resorted to a car rental service as a lure in order to trick the user into clicking on a link that masqueraded as an overdue invoice. In actuality, that link redirected the user to Google Drive for the purpose of downloading a malicious ZIP file.

The downloaded ZIP file contained a number of malicious Microsoft Windows shortcut (LNK) files that were responsible for initiating the infection process. This step led the campaign to its second stage of infection. At this point, the operation leveraged multiple layers of obfuscation before using LoLBins to advance itself. It then employed evasion checks and anti-analysis processes, steps that included the use of YouTube channels as its primary C&C infrastructure, to deliver Astaroth as its final payload.

A Look Back at Other Astaroth Attacks

Back in February 2019, Cybereason detected a campaign in which the malware disguised itself as JPEG, GIF and extension-less files in order to evade detection and prey upon Brazilian users. A few months later, the Microsoft Defender APT Research Team spotted an operation in which the malware used only system tools to perform a complex attack chain. Then, in September 2019, Cofense witnessed a phishing campaign where the threat relied on both Facebook profiles and YouTube channels to prey upon Brazilians.

Defend Against Evasive Malware

Security professionals can help defend their organizations against evasive malware like Astaroth by training their machine learning (ML) models to spot evasive tactics, specifically by training models to be familiar with all different types of adversarial techniques. At the same time, infosec personnel should use relevance scoring to fine-tune their threat intelligence for the purpose of improving their defenses against evasive campaigns that pose the greatest threat to them.

More from

When the Absence of Noise Becomes Signal: Defensive Considerations for Lazarus FudModule

In February 2023, X-Force posted a blog entitled “Direct Kernel Object Manipulation (DKOM) Attacks on ETW Providers” that details the capabilities of a sample attributed to the Lazarus group leveraged to impair visibility of the malware’s operations. This blog will not rehash analysis of the Lazarus malware sample or Event Tracing for Windows (ETW) as that has been previously covered in the X-Force blog post. This blog will focus on highlighting the opportunities for detection of the FudModule within the…

LastPass Breaches Cast Doubt on Password Manager Safety

In 2022, LastPass suffered a string of security breaches which sparked concern among cyber professionals and those impacted by the intrusions. Some called into question the way LastPass handled and responded to the incident. In addition, the situation ignited a wider conversation about the risks linked to utilizing password managers.A password manager helps users generate strong passwords and safeguards them within a digital locker. A master password secures all data, which enables users to conveniently access all their passwords for…

The Role of Finance Departments in Cybersecurity

Consumers are becoming more aware of the data companies collect about them, and place high importance on data security and privacy. Though consumers aren’t aware of every data breach, they are justifiably concerned about what happens to the data companies collect. A recent study of consumer views on data privacy and security revealed consumers are more careful about sharing data. The majority of respondents (87%) say they wouldn’t do business with companies that appear to have weak security. Study participants also…

The One Place IT Budget Cuts Can’t Touch: Cybersecurity

If IT spending is slowing, will business leaders follow a similar approach for cybersecurity budgets? Probably not. Gartner predicts that end-user spending on both security technology and services will see an annual growth rate of 11% over the next four years. And the market is anticipated to reach $267.3 billion in 2026. Many security professionals agree that security spending cuts aren’t likely. Given the current threat landscape, strong security has quickly become a business imperative. Security has become the highest…