category filters go here

Microsoft Warning on Astaroth Malware

Microsoft has recently issued a security  warning.  Their Windows Defender ATP team have discovered hackers are distributing Astaroth malware using fileless techniques.  This makes Astaroth very difficult to detect as traditional anti-malware or anti-virus software tools search for infected files.  So, they would not catch Astaroth, simply because it does not infect files.    Astaroth malware is spread through a huge spam email campaign.  The emails contain a link to a website, which if you double- clicked, would run legitimate Windows tools.  These are then used to download and communicate additional code, without saving any files.  The attack ends with the Astaroth Trojan being downloaded.  At this point, it would collect sensitive data and upload it to a remote server.   This technique is know as “living off the land” as it uses existing system tools to do all the work.

It’s worth noting that the majority of these attacks are discovered in Brazil and the URL received in the initial email uses some Portuguese terminology ie certida.htm (Portuguese for certificate), abrir_documento.htm (open document), pedido.htm (order).

What can you do to protect your system against attack?

Although challenging to detect, these fileless threats are not invisible. Microsoft advice is to make sure your Windows 10 and Windows Defender Firewall are up to date.

Office 365 users who have Advanced Threat Protection in place, will be relieved to know that it does detect the spam emails, with malicious links, which try to introduce the malware to your system.  However, ATP does not come as standard with Office 365, it is optional additional service, which has a small per user fee.   We strongly recommend all of our IT Support customers have ATP in place.  It is a powerful tool which brings an additional layer of protection to your system.  We always recommend a layered approach to cyber security and ATP is a key element of this.

If you need advice on making sure your system is cyber- secure, contact us today, and one of our Technical Consultants will be in touch to help.

 RedMosquito provide IT Support and IT Security Services thoughout Glasgow, Edinburgh, Scotland and the UK. 

RedMosquito & Telecoms

RedMosquito have recently partnered with CityFibre to bring wholesale Ethernet services into our portfolio of Managed IT and Telecoms services. This addition makes RedMosquito one of a select few Managed Service providers that can offer both voice and data services from our Glasgow helpdesk. As a provider of a Tier1 solution RedMosquito take control and […]

11 Dec 2019
microsoft logo windows 2008

What is Advanced Threat Protection?

Mircosoft’s Advanced Threat Protection is a key component of their portfolio of security technologies. The default security for Office 365 is Exchange Online Protection (EOP).  So, Advanced Threat Protection is an add on service with an additional per user month subscription.  This technology protects emails but also data contained in Office 365, so it covers […]

microsoft logo windows 2008

Office 2013 connectivity to Office 365 services

Several core Microsoft services will reach their ‘end of life’ stage during 2020.  The end of support for Windows 7 and Server 2008 in January will impact a huge number of users.    However, there are other significant changes scheduled for later in the year. From 13th October 2020,  Microsoft will only support Office 365 […]