Watch Out! Microsoft Spotted Spike in Astaroth Fileless Malware Attacks

Dubbed Astaroth, the malware trojan has been making the
rounds since at least 2017 and designed to steal users’ sensitive
information like their credentials, keystrokes, and other data,
without dropping any executable file on the disk or installing any
software on the victim’s machine.

Initially discovered by
researchers at Cybereason in February this year, Astaroath lived
off the land by running the payload directly into the memory of a
targeted computer or by leveraging legitimate system tools, such as
WMIC, Certutil, Bitsadmin, and Regsvr32, to run the malicious
code.
^[2]

While reviewing the Windows telemetry data, Andrea Lelli, a
researcher at Microsoft Defender ATP Research Team, recently
spotted a sudden unusual spike in the usage of Management
Instrumentation Command-line (WMIC) tool, leading to the disclosure
of a fileless
attack.

Further investigation revealed that the attackers behind this
campaign are distributing multi-stage Astaroth malware through
spear-phishing emails with a malicious link to a website hosting an
LNK shortcut file.

Clicking the shortcut file executes Windows built-in WMIC tool
that downloads and executes a JavaScript code, which further abuses
the Bitsadmin tool to download all other malicious payloads that
actually perform the malicious tasks of pilfering and uploading the
victim’s data while disguising itself as a system process.

The initial access and execution stages to silently install the
Astaroth malware on target devices have been demonstrated in the
above-shown attack chain.

Once on the targeted system, Astaroth tries to steal sensitive
information like credentials, keystrokes, and other data, and send
it to a remote server controlled by the attackers.

The attacker can then use this stolen data to try “moving
laterally across networks, carry out financial theft, or sell
victim information in the cybercriminal underground,” the
researcher said.

Microsoft said the various feature of its Defender ATP
next-generation protection could detect such fileless malware
attacks^[5] at each infection stage,
while other file-centric security solutions fail to protect their
customers.

Andrea said: “being fileless doesn’t mean being invisible; it
certainly doesn’t mean being undetectable. There’s no such thing as
the perfect cybercrime: even fileless malware leaves a long trail
of evidence.”

To know more about the Astaroth malware, you can head on to the
Cybereason blog
post^[6] published in
February this year, in-depth detailing about the working of the
malware and its abilities.

^[1][3]