Astaroth Trojan Uses Cloudflare Workers to Bypass AV Software

guest · Sep 2, 2019

Astaroth Trojan Uses Cloudflare Workers to Bypass AV Software
September 2, 2019
https://www.bleepingcomputer.com/ne...ses-cloudflare-workers-to-bypass-av-software/

A new malicious campaign is actively distributing a new Astaroth Trojan variant by abusing the Cloudflare Workers serverless computing platform to avoid detection and block automated analysis attempts.

"Workers has a free plan which anyone or anything can sign up and get 100,000 total requests per day. You can create unlimited number of workers per account," as Check Point malware researcher Marcel Afrahim who discovered this Astaroth variant found.
Cloudflare Workers are used by Astaroth's operators as part of a three-stage infection process, starting with a phishing e-mail that comes with an HTML attachment containing obfuscated JavaScript code and linking to a domain that sits behind Cloudflare's infrastructure.
Cloudflare Workers for payload delivery
The Astaroth payload will be downloaded using one of "ten randomized and unique Cloudflare Worker node links", each of them with 900 million possible URL variations, while on 32-bit machines—usually a sign that the malware has landed on a malware analysis sandbox—" a private Google Storage repository with a static link is used" to avoid getting their Cloudflare-based infrastructure detected.
Click to expand...

write-up with more details: Threat Actor behind Astaroth is now using Cloudflare Workers to bypass your Security Solutions

Log in or Sign up

Astaroth Trojan Uses Cloudflare Workers to Bypass AV Software

guest Guest

Log in or Sign up

Astaroth Trojan Uses Cloudflare Workers to Bypass AV Software

guest Guest

Useful Searches