Open Nav
Sign Up

Urge in Banking Malware Campaign Abusing Google Cloud Run

Bar Refael

February 21, 2024

A significant increase in banking malware campaigns exploiting Google Cloud Run has been observed, initially targeting Latin America and now extending to Europe and North America. Cisco Talos researchers have identified strains such as Astaroth, Mekiotio, and Ousaban being distributed through this method.

Attack Details:

  • Service Abused: Google Cloud Run
  • Malware Strains: Astaroth, Mekiotio, Ousaban
  • Target Regions: Latin America, Europe, North America
  • Delivery Method: Phishing emails posing as financial or tax documents
  • Notable Tactics: Use of geoplugin for cloaking, direct Trojan drop from Google Cloud Run

Description:

Google Cloud Run, a service for deploying applications, is being exploited by attackers to host and distribute banking Trojans. The campaign initially focused on Latin America but has expanded its reach. Phishing emails, often in Spanish or Italian, lure victims with themes related to invoices or government tax documents. These emails contain malicious links leading to threat actor-controlled Cloud Run Web services, where the Trojan is dropped directly, often through a malicious Microsoft Installer.

Mitigation Strategies:

  • Email Filtering: Implement advanced email filtering solutions to detect and block phishing attempts.
  • User Awareness: Educate employees about the risks of phishing emails and the importance of verifying the legitimacy of messages.
  • Endpoint Protection: Utilize endpoint security solutions with real-time threat detection capabilities to identify and mitigate malware infections.
  • Network Monitoring: Continuously monitor network traffic for suspicious activities related to Google Cloud Run services.
  • Incident Response: Prepare and regularly update an incident response plan to quickly address potential breaches.

Recommendations:

Cybersecurity teams should remain vigilant for phishing campaigns exploiting Google Cloud Run and take proactive measures to protect their organizations from these evolving threats. Regularly updating security protocols and educating users on the latest tactics used by attackers are crucial steps in mitigating the risk of banking Trojans.

Stay safe and informed,

OP Innovate Research Team.

Resources highlights

Critical Zero-Day in Microsoft SharePoint Actively Exploited (CVE-2025-53770)

A newly discovered zero-day vulnerability in Microsoft SharePoint Server, tracked as CVE-2025-53770, is currently being exploited in active attacks against on-premises environments. The flaw, rated…

Read more >

CVE-2025-53770

Over 600 Laravel Applications Vulnerable to Remote Code Execution via Leaked APP_KEYs (CVE-2018-15133, CVE-2024-55556)

Security researchers have uncovered a major RCE threat affecting over 600 Laravel applications, triggered by leaked APP_KEYs found on public GitHub repositories. Laravel's APP_KEY, typically…

Read more >

CVE-2018-15133, CVE-2024-55556

CVE-2025-3648: “Count(er) Strike” Vulnerability in ServiceNow

CVE-2025-3648, dubbed “Count(er) Strike”, is a high-severity vulnerability (CVSS 8.2) in ServiceNow's Now Platform, discovered by Varonis Threat Labs. The flaw allows both authenticated and…

Read more >

CVE-2025-3648

What to Look for in a Pentesting Platform (Beyond Just Scans)

Penetration testing platforms are a great way to centralize vulnerability discovery and triage. However, when evaluating penetration testing platforms, many organizations make the mistake of…

Read more >

pentesting platform

CVE-2016-10033: Actively Exploited Remote Code Execution (RCE) Vulnerability in PHPMailer

CVE-2016-10033 is a critical remote code execution vulnerability in PHPMailer, a widely used PHP library for sending emails. The flaw lies in the mailSend function…

Read more >

CVE-2016-10033

High-Severity WordPress Vulnerability in Forminator Plugin (CVE-2025-6463)

A critical vulnerability in the Forminator plugin, one of the most popular form-building plugins in Wordpress, allows unauthenticated attackers to delete arbitrary files on the…

Read more >

CVE-2025-6463
Under Cyber Attack?

Fill out the form and we will contact you immediately.