Open Nav
Sign Up

Urge in Banking Malware Campaign Abusing Google Cloud Run

Bar Refael

February 21, 2024

A significant increase in banking malware campaigns exploiting Google Cloud Run has been observed, initially targeting Latin America and now extending to Europe and North America. Cisco Talos researchers have identified strains such as Astaroth, Mekiotio, and Ousaban being distributed through this method.

Attack Details:

  • Service Abused: Google Cloud Run
  • Malware Strains: Astaroth, Mekiotio, Ousaban
  • Target Regions: Latin America, Europe, North America
  • Delivery Method: Phishing emails posing as financial or tax documents
  • Notable Tactics: Use of geoplugin for cloaking, direct Trojan drop from Google Cloud Run

Description:

Google Cloud Run, a service for deploying applications, is being exploited by attackers to host and distribute banking Trojans. The campaign initially focused on Latin America but has expanded its reach. Phishing emails, often in Spanish or Italian, lure victims with themes related to invoices or government tax documents. These emails contain malicious links leading to threat actor-controlled Cloud Run Web services, where the Trojan is dropped directly, often through a malicious Microsoft Installer.

Mitigation Strategies:

  • Email Filtering: Implement advanced email filtering solutions to detect and block phishing attempts.
  • User Awareness: Educate employees about the risks of phishing emails and the importance of verifying the legitimacy of messages.
  • Endpoint Protection: Utilize endpoint security solutions with real-time threat detection capabilities to identify and mitigate malware infections.
  • Network Monitoring: Continuously monitor network traffic for suspicious activities related to Google Cloud Run services.
  • Incident Response: Prepare and regularly update an incident response plan to quickly address potential breaches.

Recommendations:

Cybersecurity teams should remain vigilant for phishing campaigns exploiting Google Cloud Run and take proactive measures to protect their organizations from these evolving threats. Regularly updating security protocols and educating users on the latest tactics used by attackers are crucial steps in mitigating the risk of banking Trojans.

Stay safe and informed,

OP Innovate Research Team.

Resources highlights

Critical Cisco ISE Vulnerabilities Lead to Unauthenticated RCE (CVE-2025-20281 & CVE-2025-20282)

On June 25, 2025, Cisco disclosed and patched two critical remote code execution (RCE) vulnerabilities: CVE-2025-20281 and CVE-2025-20282, affecting its widely deployed Identity Services Engine…

Read more >

CVE-2025-20281 & CVE-2025-20282

Critical Vulnerability in MegaRAC BMC Added to CISA’s KEV: CVE-2024-54085

On June 25, 2025, CISA added CVE‑2024‑54085, a critical authentication bypass vulnerability in the MegaRAC SPx Baseboard Management Controller (BMC) firmware, to its Known Exploited…

Read more >

CVE-2024-54085

‘UMBRELLA STAND’ Malware Targets Fortinet FortiGate Firewalls

‘UMBRELLA STAND’ Malware Targets Fortinet FortiGate Firewalls The UK’s National Cyber Security Centre (NCSC) has issued an alert regarding a sophisticated malware campaign dubbed “UMBRELLA…

Read more >

umbrella stand fortinet

CVE-2025-49144: Privilege Escalation in Notepad++ Installer Enables Full SYSTEM Access

A critical local privilege escalation vulnerability in the Notepad++ v8.8.1 installer allows attackers to escalate to NT AUTHORITY\SYSTEM using binary planting techniques. Tracked as CVE-2025-49144,…

Read more >

CVE-2025-49144

Our Red Team’s Favorite Penetration Testing Tools in 2025 (And How We Use Them)

When it comes to red team operations, the tools you choose can make or break the engagement. From initial reconnaissance to post-exploitation, having a streamlined,…

Read more >

pentesting tools - op

New Linux Vulnerabilities (CVE-2025-6018 & CVE-2025-6019) Enable Full Root Access in Seconds

Security researchers have uncovered a critical privilege escalation chain in major Linux distributions that allows any local user with a session (SSH or GUI) to…

Read more >

CVE-2025-6018, CVE-2025-6019
Under Cyber Attack?

Fill out the form and we will contact you immediately.