The Malware That Must Not Be Named: Suspected Espionage Campaign Delivers 'Voldemort'

SUMMARY :

Proofpoint researchers uncovered an unusual campaign delivering custom malware named "Voldemort". The activity impersonated tax authorities from various countries and targeted dozens of organizations worldwide. The attack chain combines popular and uncommon techniques, including using Google Sheets for command and control. The malware has capabilities for information gathering and delivering additional payloads. While the campaign exhibits some characteristics of cybercriminal activity, the nature and capabilities of the malware suggest an espionage objective. The threat actor utilized multiple techniques becoming more popular in the cybercrime landscape, making attribution challenging. The campaign's unusual combination of sophisticated and basic elements makes it difficult to assess the threat actor's capabilities and ultimate goals.

OPENCTI LABELS :

apt,cobalt strike,espionage,tax authorities,voldemort


Open in NetmanageIT OpenCTI Public Instance with below link!


Use public read only username and password on login page.

NOTE : Use Public READ only user credentials on login page banner.


The Malware That Must Not Be Named: Suspected Espionage Campaign Delivers 'Voldemort'