Summary:
A financially motivated threat actor based in Latin America (LATAM), codenamed FLUXROOT, has been leveraging Google Cloud serverless projects to conduct credential phishing campaigns, underscoring the misuse of cloud computing for nefarious activities. Google's biannual Threat Horizons Report emphasizes that serverless architectures are highly attractive to developers and enterprises due to their flexibility, cost-effectiveness, and ease of use. However, these same features also appeal to threat actors, who exploit serverless computing services across all cloud providers. These malicious actors use these platforms to deliver and communicate with their malware, host phishing pages, and execute malicious scripts designed specifically for serverless environments.


The FLUXROOT campaign involved using Google Cloud container URLs to host phishing pages aimed at harvesting login information for Mercado Pago, a popular online payments platform in the LATAM region. FLUXROOT, known for distributing the Grandoreiro banking trojan, has also utilized legitimate cloud services like Microsoft Azure and Dropbox in their recent campaigns.


In a separate incident, another threat actor named PINEAPPLE weaponized Google's cloud infrastructure to spread the Astaroth stealer malware targeting Brazilian users. PINEAPPLE used compromised Google Cloud instances and self-created Google Cloud projects to generate container URLs on legitimate Google Cloud serverless domains.These URLs hosted landing pages that redirected targets to malicious infrastructure, leading to the deployment of Astaroth.


Security Officer Comments:
PINEAPPLE also attempted to bypass email gateway protections by using mail forwarding services that do not discard messages with failed Sender Policy Framework (SPF) records. Additionally, they incorporated unexpected data in the SMTP Return-Path field to trigger DNS request timeouts, causing email authentication checks to fail.


To combat these malicious activities, Google has taken steps to mitigate the threat by taking down the malicious Google Cloud projects and updating its Safe Browsing lists. The weaponization of cloud services and infrastructure by threat actors has been driven by the increased adoption of cloud across various industries. This trend allows adversaries to blend into normal network activities, making detection more challenging.


Suggested Corrections: