Have you met Delilah? The first Insider Threat Trojan

Criminal recruitment of insiders is becoming an industry now with the release of a new Trojan called "Delilah". Delilah recruits targeted insiders via social engineering and/or extortion, sometimes using ransomware techniques. It remains a closely held Trojan not yet available on the common black market, and is only shared amongst closed hacker groups, according to threat intelligence firm Diskin Advanced Technologies (DAT).

DAT reports that the bot is delivered to victims via downloads from multiple popular adult and gaming sites. Once installed the hidden bot gathers enough personal information from the victim so that the individual can later be manipulated or extorted.  This includes information on the victim's family and workplace. The bot comes with a social engineering plug in that connects to webcam operations so that the victim can be filmed without his or her knowledge.

Also according to DAT, instructions to victims usually involve usage of VPN services, TOR and comprehensive deletion of browser history (probably to remove audit trails).  These bots still require a high level of human involvement to identify and prioritize individuals who can be extorted into operating as insiders at desirable target organizations.  Criminals who want to use the bot can also acquire managed social engineering and fraudster services to help them out, in case they lack those specific skills.

Reportedly, the Trojan is still buggy and sometimes yields error messages when the webcam function is invoked. Infected devices are also subject to constant monitor freezing – sometimes for over ten seconds – because of the high volume of real time screen shots.  Threat actors want these bugs resolved.

Solutions

Insider threat detection and mitigation is a rich subject that we explored in a recent blog Insider threats escalate and thrive in the Dark Web . A more comprehensive research note on this topic will be published this later this Summer. Surely, to combat Delilah and similar bots, it is especially important to collect and analyze endpoint data and information on VPN usage and TOR connections. Often times, the optimal way to do this is to feed EDR output into UEBA systems for correlations and advanced analysis of various events. Organizations should also seek to prevent endpoints from getting infected in the first place by preventing employees from visiting high risk adult and gaming sites using organizational systems.

Conclusion

Insider threats are continuing to increase with active recruitment of insiders from organized criminals operating on the dark web.  With Trojans like Delilah, organizations should expect insider recruitment to escalate further and more rapidly.  This will only add to the volume of insider threats caused by disgruntled employees selling their services on the Dark Web in order to harm their employers.