Guildma: Analyzing Astaroth Malware Deployment via Brazilian Portuguese Emails

Guildma, a subset of the larger TA551 malware operations, represents a sophisticated campaign most recently observed deploying Astaroth malware through email lures crafted in Brazilian Portuguese. This specific technique targeted Brazilian financial sector entities, surfacing around late 2023, leveraging highly localized social engineering to bypass typical defenses. The threat actors behind Guildma demonstrated a profound understanding of their targets, employing advanced evasion tactics and language-specific cues to establish authenticity.

Through an analysis of the Guildma campaign, researchers were able to document the persistent threat actors’ strategy to instrumentalize common email-based attack vectors to deliver Astaroth, a known information-stealing malware. This research highlights the integration of regional language nuances, convincingly cloaking malicious intents in legitimate-seeming communications.

How It Was Built

The attackers behind Guildma structured their campaign with meticulous intent, focusing on several key aspects: infrastructure, delivery, and execution. They utilized a network of compromised servers located in Brazil for infrastructure, masking malicious traffic with local network geographies to avoid raising suspicion. Part of these tactics included mimicry of regional service providers in both domains and email sender addresses.


Subject: "Fatura Vencida: Atualização de Pagamento Necessária"

From: "Atendimento ao Cliente <contato@bradesco-portal.com.br>"

Reply-To: "contato@bradesco-portal.com.br"

The delivery vector primarily used spear phishing emails containing deceptive document attachments or links leading to spoofed landing pages. These emails mimicked communications from major Brazilian financial institutions. Once opened, the attachments executed scripts to download the Astaroth malware stealthily in the background. This deployment used non-executable file types, often masking scripts within .PDF or .DOC files using complex obfuscation techniques.

Why It Worked

The success of the Guildma operation can be attributed to several factors instrumental in its execution. Firstly, the localization of language played a crucial role. Emails were written in fluent Brazilian Portuguese, reflecting informal client communication styles typical among Brazilian financial institutions. This minimized suspicion among recipients.

Secondly, the choice of domains and sender addresses was precisely engineered to mimic legitimate entities. Attackers avoided international domain suffixes that might trigger anti-phishing alerts. The subtle changes in domains and the use of

Reply-To

fields further enhanced perceived legitimacy.

Finally, the use of document attachments instead of executable files allowed attackers to circumvent basic defenses reliant on executable scans. By embedding scripts in document macros, attackers could trigger malware execution while keeping the end payload hidden from view initially.

Operator Takeaways

For red teamers, the Guildma case study offers several actionable insights. Firstly, consider the importance of cultural and linguistic tailoring in crafting spear phishing campaigns. Ensuring that your phishing narratives resonate with your target audiences can significantly enhance engagement rates.

Next, leverage domain and infrastructure mimicry techniques. This involves registering domain names similar to target brands and using infrastructure closer to the geographic location of the target, thus reducing the odds of activation of geographic security alerts.

Lastly, the effectiveness of using document-based payload delivery systems shows that non-executable malwares can be a reliable method to bypass traditional anti-virus solutions, especially when the payload is neatly embedded within macros or seemingly inert file formats.

Good / Better / Best

Good: Crafting phishing emails in the target’s native language using local style and behavioral cues.
Better: Embedding malware execution scripts within document macros to bypass simple anti-virus checks effectively.
Best: Implementing domain and reply-to identity strategies that mimic local legitimate entities, enhancing perceived trustworthiness and email authenticity.