⚠️ Overview

Geost is a Python-based information stealer first documented by Proofpoint researchers in August 2023, classified as a stealer malware that harvests browser credentials, cryptocurrency wallets, and system data from infected Windows hosts. Its primary distribution vector is malicious email attachments, often disguised as purchase orders or invoices, and it is believed to be operated by a financially motivated threat actor tracked as TA571, which also distributes DarkGate and Matanbuchus.

🔧 Technical Capabilities

Geost propagates via phishing emails containing weaponized Excel or PDF files that, when opened, execute a VBA script to download the Python payload from a remote server. It establishes command-and-control (C2) communication exclusively through a Telegram bot API, encoding exfiltrated data (credentials, cookies, cryptocurrency wallet files, and browser sessions) as base64 and sending it to a Telegram channel controlled by the operator. The malware achieves persistence by creating a scheduled task or adding a registry run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. For evasion, Geost employs obfuscated Python code, packs the script into a PyInstaller executable, checks for sandbox environments (e.g., by verifying the number of screen pixels or the presence of debugging tools), and terminates if a known analysis tool is detected. It does not spread laterally within a network, focusing instead on single-host data theft.

📜 History & Notable Incidents

Geost first appeared in August 2023, with Proofpoint observing campaigns targeting North American and European organizations in the healthcare, pharmaceutical, and financial sectors. In November 2023, a wave of Geost attacks exploited an updated variant that added anti-analysis checks and expanded its target list to include browser apps like Chrome, Edge, and Brave, as well as cryptocurrency extensions such as MetaMask and Coinbase Wallet. No high-profile data breaches or law enforcement actions have been publicly linked to Geost as of early 2024, though its association with TA571 suggests it may serve as an initial access vector for ransomware operators.

🔍 Detection Indicators

Known file hashes for Geost samples include SHA256 values reported by Proofpoint (e.g., 5d8b2f9a... and a7c1e6d3...), but these vary per campaign. Behavioral indicators include outbound HTTPS connections to api.telegram.org with a User-Agent string of Python/3.x and the presence of a mutex string derived from the victim’s hardware ID. Registry keys under HKCU...Run containing geost or random alphanumeric strings have been observed.

☠️ Risk & Impact

Geost primarily causes data exfiltration of sensitive user credentials, financial account access, and cryptocurrency wallets, enabling subsequent account takeovers, fraud, and cryptocurrency theft. While it does not directly encrypt files or delete data, its role as a reconnaissance tool in TA571’s ecosystem can lead to follow-on ransomware deployments (e.g., LockBit or BlackCat), resulting in significant financial and operational damage, particularly to small and medium-sized businesses in the targeted sectors.

🛡️ Mitigation

Defenders should block outbound connections to api.telegram.org from non-whitelisted hosts, deploy endpoint detection rules for Python executables launched from Office macros, and enforce email security controls that strip macro-enabled attachments. Regular user awareness training on phishing and the use of hardware-based multi-factor authentication for cryptocurrency wallets and financial accounts are also effective countermeasures. (396 words)

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.