Delilah is a strain of malware developed to extort victims into stealing insider data, it was first discovered on crime forums by the Israeli intelligence firm Diskin Advanced Technologies.
Deliah is not distributed in open crimeware forums, instead, it is shared in among exclusive criminal communities.
Delilah represents a novelty in the malware landscape, it relies on a combination of social engineering and extortion techniques.
The Gartner security expert Avivah Litan explained that the trojan was specifically designed to target employees, it gathers information on the victims in order to use them in extortion schema.
“Delilah recruits targeted insiders via social engineering and/or extortion, sometimes using ransomware techniques. It remains a closely held Trojan not yet available on the common black market, and is only shared amongst closed hacker groups, according to threat intelligence firm Diskin Advanced Technologies (DAT).” Litan wrote in a blog post.
“Once installed the hidden bot gathers enough personal information from the victim so that the individual can later be manipulated or extorted. This includes information on the victim’s family and workplace. ”
“This will only add to the volume of insider threats caused by disgruntled employees selling their services on the Dark Web in order to harm their employers.”
The bot leverages on a component that allows spying on victims through their webcam.
“The bot comes with a social engineering plug-in that connects to webcam operations so that the victim can be filmed without his or her knowledge.”
The experts from the Israeli company explained that criminals need sophisticated social engineering techniques in order to force the victims into committing insider theft.
Delilah is delivered through gaming and adult sites, for this reason, it is suggested to organizations to prevent employees from visiting potentially malicious websites.
Insider threats are very insidious and malicious codes like Delilah could easily allow crooks to recruit insiders.
“With Trojans like Delilah, organizations should expect insider recruitment to escalate further and more rapidly. This will only add to the volume of insider threats caused by disgruntled employees selling their services on the Dark Web in order to harm their employers.”
(Security Affairs – Insider threat, hacking)
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.