Voldemort espionage malware hits organizations across the globe

Magnifying glass enlarging the word 'malware' in computer machine code
(Image credit: Shutterstock)

More than 70 organizations around the world, operating in different industries, have already been hit by a brand new piece of malware called ‘Voldemort’. This is according to cybersecurity researchers Proofpoint, who observed the novel campaign and wrote an in-depth analysis here.

The researchers don’t know exactly who is behind this campaign, since its operation is a “Frankensteinian amalgamation of clever and sophisticated capabilities”, while at the same time also being “very basic” in terms of techniques and functionality.

Whoever it is, it’s using techniques that are growing increasingly popular in the cybercriminal world.

Simple backdoor

Speaking of techniques, they start with the usual - phishing. More than 20,000 emails were sent last month, targeting insurance companies, aerospace firms, organizations in the transportation business, as well as universities. These emails discuss (un)paid taxes, and come with attachments. There are a few steps to go through after downloading these files, but ultimately, the crooks will drop CiscoSparkLauncher.dll, a vulnerable DLL that can be side-loaded and used to drop Voldemort.

The backdoor can do two simple things - steal sensitive data, and deploy additional payloads. What makes it stand out is that it doesn’t have a command-and-control (C2) server, but rather uses a Google Sheets file for receiving orders and exfiltrating information.

“Interestingly, the actor used multiple techniques that are becoming more popular in the cybercrime landscape, which – in addition to the volume and targeting that is also more aligned with ecrime campaigns – is unusual,” the researchers said. “While the lures in the campaign are more typical of a criminal threat actor, the features included in the backdoor are more similar to the features typically found in the tools used for espionage.”

Since the researchers were unable to attribute the campaign to any specific actor, they also weren’t able to determine the end goal.

Via Infosecurity Magazine

More from TechRadar Pro

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Read more
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
Juniper VPN gateways targeted by stealthy "magic" malware
Code Skull
This dangerous new ransomware is hitting Windows, ARM, ESXi systems
A digital representation of a lock
Security experts are being targeted with fake malware discoveries
Illustration of a laptop with a magnifying glass exposing a beetle on-screen
Microsoft Outlook targeted by new malware attacks allowing sneaky hijacking
A computer being guarded by cybersecurity.
Huge cyberattack found hitting vulnerable Microsoft-signed legacy drivers to get past security
An American flag flying outside the US Capitol building against a blue sky
US military and defense contractors hit with Infostealer malware
Latest in Security
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
Broadcom warns of worrying security flaws affecting VMware tools
URL phishing
HaveIBeenPwned owner suffers phishing attack that stole his Mailchimp mailing list
Ransomware
Cl0p resurgence drives ransomware attacks to new highs in 2025
Google Chrome
Google Chrome security flaw could have let hackers spy on all your online habits
cybersecurity
Chinese government hackers allegedly spent years undetected in foreign phone networks
Data leak
A major Keenetic router data leak could put a million households at risk
Latest in News
inZOI promotional material.
inZOI has become the most wishlisted game on Steam, but I wouldn't get too caught up in the hype
Xbox Series X and Xbox wireless controller set to a green background
Xbox Insiders are currently testing a new Game Hub feature that looks useful, but I've got mixed feelings about it
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
Broadcom warns of worrying security flaws affecting VMware tools
Microsoft Surface Laptop and Surface Pro devices on a table.
Hate Windows 11’s search? Microsoft is fixing it with AI, and that almost makes me want to buy a Copilot+ PC
Oura Ring 4
Activity tracking on Oura Ring is about to get a whole lot better, but I've got bad news about your step count
Google Pixel Buds Pro 2
Cleaned your Pixel Buds Pro 2 recently? If not, you might be getting worse sound