We review vendors based on rigorous testing and research but also take into account your feedback and our affiliate commission with providers. Some providers are owned by our parent company.
Learn more
vpnMentor was established in 2014 to review VPN services and cover privacy-related stories. Today, our team of hundreds of cybersecurity researchers, writers, and editors continues to help readers fight for their online freedom in partnership with Kape Technologies PLC, which also owns the following products: ExpressVPN, CyberGhost, and Private Internet Access which may be ranked and reviewed on this website. The reviews published on vpnMentor are believed to be accurate as of the date of each article, and written according to our strict reviewing standards that prioritize professional and honest examination of the reviewer, taking into account the technical capabilities and qualities of the product together with its commercial value for users. The rankings and reviews we publish may also take into consideration the common ownership mentioned above, and affiliate commissions we earn for purchases through links on our website. We do not review all VPN providers and information is believed to be accurate as of the date of each article.
Advertising Disclosure

vpnMentor was established in 2014 to review VPN services and cover privacy-related stories. Today, our team of hundreds of cybersecurity researchers, writers, and editors continues to help readers fight for their online freedom in partnership with Kape Technologies PLC, which also owns the following products: ExpressVPN, CyberGhost, and Private Internet Access which may be ranked and reviewed on this website. The reviews published on vpnMentor are believed to be accurate as of the date of each article, and written according to our strict reviewing standards that prioritize professional and honest examination of the reviewer, taking into account the technical capabilities and qualities of the product together with its commercial value for users. The rankings and reviews we publish may also take into consideration the common ownership mentioned above, and affiliate commissions we earn for purchases through links on our website. We do not review all VPN providers and information is believed to be accurate as of the date of each article.

Google Cloud Run Used to Distribute Banking Trojans

Google Cloud Run Used to Distribute Banking Trojans
Hendrik Human Published on 23rd February 2024 Cybersecurity Researcher

Security researchers have identified a widespread campaign where cybercriminals are misusing Google Cloud Run to disseminate banking trojans, namely the malware known as Astaroth, Mekotio, and Ousaban. As reported by Cisco Talos researchers, the first surge of misuse was observed in September 2023.

This campaign is particularly concerning considering Google Cloud Run’s cost-effectiveness and ability to bypass standard security blocks and filters.

The attack involves sending phishing emails that mimic financial statements and invoices, or in some cases, communications from government agencies or tax authorities. These emails contain links that redirect users to malicious payloads hosted on Google Cloud Run. In some instances, the attackers deploy MSI installer files directly. In others, they use a 302 redirect to Google Cloud Storage, where the malicious files are stored in ZIP archives.

When one of these malicious files is executed, it triggers the download and installation of secondary payloads using BITSAdmin. BITSAdmin is a legitimate Windows tool, making it more effective at bypassing detection mechanisms.

So far, these emails have been found to be written primarily in Spanish and occasionally in Italian, with the campaign seemingly focusing on the Latin American region.

The malware involved in this campaign — Astaroth, Mekotio, and Ousaban — exhibits sophisticated mechanisms designed to stealthily infiltrate systems, maintain persistence, and exfiltrate sensitive financial data.

Astaroth, in particular, has expanded its target base to over 300 financial institutions across 15 countries. It employs advanced techniques such as keylogging, screen capture, and clipboard monitoring to steal banking credentials.

Mekotio has been active for several years, and focuses on the Latin America region. It can steal banking credentials and other personal information, make fraudulent transactions, and manipulate the victim’s browser to redirect them to phishing sites. Ousaban, on the other hand, is a trojan that logs keystrokes, captures screenshots, and phishes for bank credentials via fake banking portals.

The Cisco Talos team observed a later deployment of Ousaban following an Astaroth infection. This pattern suggests either a collaborative effort between the two operators of these malware families or perhaps a single orchestrator controlling both.

Google has been alerted to the misuse of its Cloud Run service for malicious purposes. An official statement obtained by BleepingComputer reads:

“We’re appreciative of the researcher’s work in identifying and reporting the use of Cloud Run to direct users to malicious content.

We have removed the offending links and are looking into strengthening our mitigation efforts to help prevent this type of nefarious activity.”

About the Author

Hendrik is a writer at vpnMentor, specializing in VPN comparisons and user guides. With 5+ years of experience as a tech and cybersecurity writer, plus a background in corporate IT, he brings a variety of perspectives to test VPN services and analyze how they address the needs of different users.

Please, comment on how to improve this article. Your feedback matters!

Leave a comment

Sorry, links are not allowed in this field!

Name should contain at least 3 letters

The field content should not exceed 80 letters

Sorry, links are not allowed in this field!

Please enter a valid email address