Delilah is the first extortion trojan that spies on victims and collects information to force them in doing malicious activities from inside.
Delilah is a strain of malware developed to extort victims into stealing insider data, it was first discovered on crime forums by the Israeli intelligence firm Diskin Advanced Technologies.
Deliah is not distributed in open crimeware forums, instead, it is shared in among exclusive criminal communities.
Delilah represents a novelty in the malware landscape, it relies on a combination of social engineering and extortion techniques.
The Gartner security expert Avivah Litan explained that the trojan was specifically designed to target employees, it gathers information on the victims in order to use them in extortion schema.
“Delilah recruits targeted insiders via social engineering and/or extortion, sometimes using ransomware techniques. It remains a closely held Trojan not yet available on the common black market, and is only shared amongst closed hacker groups, according to threat intelligence firm Diskin Advanced Technologies (DAT).” Litan wrote in a blog post.
“Once installed the hidden bot gathers enough personal information from the victim so that the individual can later be manipulated or extorted. This includes information on the victim’s family and workplace. ”
“This will only add to the volume of insider threats caused by disgruntled employees selling their services on the Dark Web in order to harm their employers.”
The bot leverages on a component that allows spying on victims through their webcam.
“The bot comes with a social engineering plug-in that connects to webcam operations so that the victim can be filmed without his or her knowledge.”
The experts from the Israeli company explained that criminals need sophisticated social engineering techniques in order to force the victims into committing insider theft.
Delilah is delivered through gaming and adult sites, for this reason, it is suggested to organizations to prevent employees from visiting potentially malicious websites.
Insider threats are very insidious and malicious codes like Delilah could easily allow crooks to recruit insiders.
“With Trojans like Delilah, organizations should expect insider recruitment to escalate further and more rapidly. This will only add to the volume of insider threats caused by disgruntled employees selling their services on the Dark Web in order to harm their employers.”
Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer.
Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US.
Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines.
Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.