Delilah, the first Trojan to recruit Insiders

Delilah is the first extortion trojan that spies on victims and collects information to force them in doing malicious activities from inside.

Delilah is a strain of malware developed to extort victims into stealing insider data, it was first discovered on crime forums by the Israeli intelligence firm Diskin Advanced Technologies.

Deliah is not distributed in open crimeware forums, instead, it is shared in among exclusive criminal communities.

Delilah represents a novelty in the malware landscape, it relies on a combination of social engineering and extortion techniques.

The Gartner security expert Avivah Litan explained that the trojan was specifically designed to target employees, it gathers information on the victims in order to use them in extortion schema.

“Delilah recruits targeted insiders via social engineering and/or extortion, sometimes using ransomware techniques. It remains a closely held Trojan not yet available on the common black market, and is only shared amongst closed hacker groups, according to threat intelligence firm Diskin Advanced Technologies (DAT).” Litan wrote in a blog post. 

“Once installed the hidden bot gathers enough personal information from the victim so that the individual can later be manipulated or extorted. This includes information on the victim’s family and workplace. ” 

“This will only add to the volume of insider threats caused by disgruntled employees selling their services on the Dark Web in order to harm their employers.”

The bot leverages on a component that allows spying on victims through their webcam.

“The bot comes with a social engineering plug-in that connects to webcam operations so that the victim can be filmed without his or her knowledge.”

The experts from the Israeli company explained that criminals need sophisticated social engineering techniques in order to force the victims into committing insider theft.

Delilah is delivered through gaming and adult sites, for this reason, it is suggested to organizations to prevent employees from visiting potentially malicious websites.

Insider threats are very insidious and malicious codes like Delilah could easily allow crooks to recruit insiders.

“With Trojans like Delilah, organizations should expect insider recruitment to escalate further and more rapidly.  This will only add to the volume of insider threats caused by disgruntled employees selling their services on the Dark Web in order to harm their employers.”

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs – Insider threat, hacking)