Voldemort espionage malware hits organizations across the globe

More than 70 companies were struck by malware with interesting techniques

When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.

More than 70 organizations around the world, operating in different industries, have already been hit by a brand new piece ofmalwarecalled ‘Voldemort’. This is according to cybersecurity researchers Proofpoint, who observed the novel campaign and wrote an in-depth analysishere.

The researchers don’t know exactly who is behind this campaign, since its operation is a “Frankensteinian amalgamation of clever and sophisticated capabilities”, while at the same time also being “very basic” in terms of techniques and functionality.

Whoever it is, it’s using techniques that are growing increasingly popular in the cybercriminal world.

Simple backdoor

Speaking of techniques, they start with the usual - phishing. More than 20,000 emails were sent last month, targeting insurance companies, aerospace firms, organizations in the transportation business, as well as universities. These emails discuss (un)paid taxes, and come with attachments. There are a few steps to go through after downloading these files, but ultimately, the crooks will drop CiscoSparkLauncher.dll, a vulnerable DLL that can be side-loaded and used to drop Voldemort.

The backdoor can do two simple things - steal sensitive data, and deploy additional payloads. What makes it stand out is that it doesn’t have a command-and-control (C2) server, but rather uses aGoogleSheets file for receiving orders and exfiltrating information.

“Interestingly, the actor used multiple techniques that are becoming more popular in the cybercrime landscape, which – in addition to the volume and targeting that is also more aligned with ecrime campaigns – is unusual,” the researchers said. “While the lures in the campaign are more typical of a criminal threat actor, the features included in the backdoor are more similar to the features typically found in the tools used for espionage.”

Since the researchers were unable to attribute the campaign to any specific actor, they also weren’t able to determine the end goal.

Are you a pro? Subscribe to our newsletter

Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!

ViaInfosecurity Magazine

More from TechRadar Pro

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

This new phishing strategy utilizes GitHub comments to distribute malware

Should your VPN always be on?

Red One isn’t perfect but it proves we need more action-packed Christmas movies