Story image

Have you met Delilah? The first Insider Threat Trojan

15 Jul 16

Criminal recruitment of insiders is becoming an industry now with the release of a new Trojan called “Delilah”. Delilah recruits targeted insiders via social engineering and/or extortion, sometimes using ransomware techniques. It remains a closely held Trojan not yet available on the common black market, and is only shared amongst closed hacker groups, according to threat intelligence firm Diskin Advanced Technologies (DAT).

DAT reports that the bot is delivered to victims via downloads from multiple popular adult and gaming sites. Once installed the hidden bot gathers enough personal information from the victim so that the individual can later be manipulated or extorted.  This includes information on the victim’s family and workplace. The bot comes with a social engineering plug in that connects to webcam operations so that the victim can be filmed without his or her knowledge.

Also according to DAT, instructions to victims usually involve usage of VPN services, TOR and comprehensive deletion of browser history (probably to remove audit trails).  These bots still require a high level of human involvement to identify and prioritize individuals who can be extorted into operating as insiders at desirable target organizations.  Criminals who want to use the bot can also acquire managed social engineering and fraudster services to help them out, in case they lack those specific skills.

Reportedly, the Trojan is still buggy and sometimes yields error messages when the webcam function is invoked. Infected devices are also subject to constant monitor freezing – sometimes for over ten seconds – because of the high volume of real time screen shots.  Threat actors want these bugs resolved.

Solutions

Insider threat detection and mitigation is a rich subject that we explored in a recent blog Insider threats escalate and thrive in the Dark Web . A more comprehensive research note on this topic will be published this later this Summer. Surely, to combat Delilah and similar bots, it is especially important to collect and analyze endpoint data and information on VPN usage and TOR connections. Often times, the optimal way to do this is to feed EDR output into UEBA systems for correlations and advanced analysis of various events. Organizations should also seek to prevent endpoints from getting infected in the first place by preventing employees from visiting high risk adult and gaming sites using organizational systems.

Conclusion

Insider threats are continuing to increase with active recruitment of insiders from organized criminals operating on the dark web.  With Trojans like Delilah, organizations should expect insider recruitment to escalate further and more rapidly.  This will only add to the volume of insider threats caused by disgruntled employees selling their services on the Dark Web in order to harm their employers.

Article by Avivah Litan, Gartner analyst

Oracle Java Card update boosts security for IoT devices
"Java Card 3.1 is very significant to the Internet of Things, bringing interoperability, security and flexibility to a fast-growing market currently lacking high-security and flexible edge security solutions."
Sophos hires ex-McAfee SVP Gavin Struther
After 16 years as the APAC senior vice president and president for McAfee, Struthers is now heading the APJ arm of Sophos.
Half of companies unable to detect IoT device breaches
A Gemalto study also shows that the of blockchain technology to help secure IoT data, services and devices has doubled in a year.
Huawei founder publically denies spying allegations
“After all the evidence is made public, we will rely on the justice system.”
Malware downloader on the rise in Check Point’s latest Threat Index
Organisations continue to be targeted by cryptominers, despite an overall drop in value across all cryptocurrencies in 2018.
IoT breaches: Nearly half of businesses still can’t detect them
The Internet of Thing’s (IoT’s) rapid rise to prominence may have compromised its security, if a new report from Gemalto is anything to go by.
Carbon Black: What does cybersecurity have in store for 2019?
Tom Kellerman has shared five insights for the year ahead, including a particularly bold one.
Hands-on review: The Ekster Wallet protects your cards against RFID attacks
For some time now, I’ve been protecting my credit cards with tinfoil. The tinfoil hat does attract a lot of comments, but thanks to Ekster, those days are now happily behind me.