sb-as logo
Story image

Have you met Delilah? The first Insider Threat Trojan

15 Jul 2016

Criminal recruitment of insiders is becoming an industry now with the release of a new Trojan called “Delilah”. Delilah recruits targeted insiders via social engineering and/or extortion, sometimes using ransomware techniques. It remains a closely held Trojan not yet available on the common black market, and is only shared amongst closed hacker groups, according to threat intelligence firm Diskin Advanced Technologies (DAT).

DAT reports that the bot is delivered to victims via downloads from multiple popular adult and gaming sites. Once installed the hidden bot gathers enough personal information from the victim so that the individual can later be manipulated or extorted.  This includes information on the victim’s family and workplace. The bot comes with a social engineering plug in that connects to webcam operations so that the victim can be filmed without his or her knowledge.

Also according to DAT, instructions to victims usually involve usage of VPN services, TOR and comprehensive deletion of browser history (probably to remove audit trails).  These bots still require a high level of human involvement to identify and prioritize individuals who can be extorted into operating as insiders at desirable target organizations.  Criminals who want to use the bot can also acquire managed social engineering and fraudster services to help them out, in case they lack those specific skills.

Reportedly, the Trojan is still buggy and sometimes yields error messages when the webcam function is invoked. Infected devices are also subject to constant monitor freezing – sometimes for over ten seconds – because of the high volume of real time screen shots.  Threat actors want these bugs resolved.

Solutions

Insider threat detection and mitigation is a rich subject that we explored in a recent blog Insider threats escalate and thrive in the Dark Web . A more comprehensive research note on this topic will be published this later this Summer. Surely, to combat Delilah and similar bots, it is especially important to collect and analyze endpoint data and information on VPN usage and TOR connections. Often times, the optimal way to do this is to feed EDR output into UEBA systems for correlations and advanced analysis of various events. Organizations should also seek to prevent endpoints from getting infected in the first place by preventing employees from visiting high risk adult and gaming sites using organizational systems.

Conclusion

Insider threats are continuing to increase with active recruitment of insiders from organized criminals operating on the dark web.  With Trojans like Delilah, organizations should expect insider recruitment to escalate further and more rapidly.  This will only add to the volume of insider threats caused by disgruntled employees selling their services on the Dark Web in order to harm their employers.

Article by Avivah Litan, Gartner analyst

Story image
Fujitsu new tech ensures inter-business data trust
The technology can verify when and by whom the data was created, and whether it has been tampered with, to ensure trusted data exchange.More
Story image
Why best-practice threat data management provides confident automation
Understanding an organisation’s threat landscape requires having both the right threat data sources and the proper prioritisation to derive actionable threat intelligence for your organisation. More
Story image
Research: Younger cybersecurity pros more fearful of being replaced by AI
According to the findings, 53% of respondents under 45 years old either agreed or strongly agreed that AI and ML are a threat to their job security, despite 89% of this demographic believing that it would improve their jobs.More
Story image
Financial institutions in APAC region to invest millions in fraud prevention
"The pandemic is creating a lot of uncertainty, but the majority of FIs in APAC recognise that an end to end fraud management platform is strategic to differentiating themselves from the highly disruptive landscape they are playing in."More
Story image
WhiteHawk ramps up cyber revenues with US$1.5 million contract extension
WhiteHawk Limited has been awarded a fiscal 2021 option extension of US$1.5 million (A$2.1M) under an existing seven-year contract.More
Story image
Security and operations collaboration key to success post COVID-19
“We are in an ultra-hybrid world with multi-everything, and in order to successfully navigate this landscape, ITOps, DevOps, and SecOps teams need to more closely align."More