Astaroth, Mekotio & Ousaban abusing Google Cloud Run in LATAM-focused malware campaigns
Summary: Since September 2023, Cisco Talos has observed a significant increase in malicious emails using Google Cloud Run to deliver the Astaroth, Mekotio, and Ousaban banking trojans, mostly to victims in Latin American countries, with the current Astaroth variant targeting more than 300 institutions across 15 Latin American countries. The emails, largely sent in Spanish from systems mostly located in Brazil, use invoice and tax-document themes and link to run[.]app URLs that redirect victims to attacker-deployed Cloud Run services delivering malicious MSI files, with all three malware families observed being delivered from the same Google Cloud storage bucket.
What you should know: Google Cloud Run's free tier of two million web requests per month and $300 in new-account credits gives adversaries inexpensive distribution infrastructure on a platform most organizations likely do not block internal systems from reaching, and the same Cloud Project was used to push both Mekotio and Astaroth payloads at once.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026