More than 70 organizations around the world, operating in different industries, have already been hit by a brand new piece of malware called ‘Voldemort’. This is according to cybersecurity researchers Proofpoint, who observed the novel campaign and wrote an in-depth analysis here.
The researchers don’t know exactly who is behind this campaign, since its operation is a “Frankensteinian amalgamation of clever and sophisticated capabilities”, while at the same time also being “very basic” in terms of techniques and functionality.
Whoever it is, it’s using techniques that are growing increasingly popular in the cybercriminal world.
Simple backdoor
Speaking of techniques, they start with the usual – phishing. More than 20,000 emails were sent last month, targeting insurance companies, aerospace firms, organizations in the transportation business, as well as universities. These emails discuss (un)paid taxes, and come with attachments. There are a few steps to go through after downloading these files, but ultimately, the crooks will drop CiscoSparkLauncher.dll, a vulnerable DLL that can be side-loaded and used to drop Voldemort.
The backdoor can do two simple things – steal sensitive data, and deploy additional payloads. What makes it stand out is that it doesn’t have a command-and-control (C2) server, but rather uses a Google Sheets file for receiving orders and exfiltrating information.
“Interestingly, the actor used multiple techniques that are becoming more popular in the cybercrime landscape, which – in addition to the volume and targeting that is also more aligned with ecrime campaigns – is unusual,” the researchers said. “While the lures in the campaign are more typical of a criminal threat actor, the features included in the backdoor are more similar to the features typically found in the tools used for espionage.”
Since the researchers were unable to attribute the campaign to any specific actor, they also weren’t able to determine the end goal.
