Delilah is the first extortion trojan that spies on victims and collects information to force them in doing malicious activities from inside.
Delilah is a strain of malware developed to extortÂ victims into stealing insider data, it was first discovered on crime forums by the Israeli intelligence firm Diskin Advanced Technologies.
Deliah is not distributed in open crimeware forums, instead, it is shared in among exclusive criminal communities.
Delilah represents a novelty in the malware landscape, it relies on a combination of social engineering andÂ extortionÂ techniques.
The Gartner security expert Avivah Litan explained that the trojan was specifically designed to target employees, it gathers information on the victims in order to use them in extortion schema.
âDelilah recruits targeted insiders via social engineering and/or extortion, sometimes using ransomware techniques. It remains a closely held Trojan not yet available on the common black market, and is only shared amongst closed hacker groups, according to threat intelligence firm Diskin Advanced Technologies (DAT).âÂ Litan wrote in a blog post.Â
âOnce installed the hidden bot gathers enough personal information from the victim so that the individual can later be manipulated or extorted. This includes information on the victimâs family and workplace. âÂ
âThis will only add to the volume of insider threats caused by disgruntled employees selling their services on the Dark Web in order to harm their employers.â
The bot leverages on a component thatÂ allows spying on victims through their webcam.
âThe bot comes with a social engineering plug-in that connects to webcam operations so that the victim can be filmed without his or her knowledge.â
The experts from the Israeli company explainedÂ that criminals need sophisticated social engineering techniques in order to force the victims into committing insider theft.
Delilah is delivered through gaming and adult sites, for this reason, it is suggested to organizations to prevent employees from visiting potentially malicious websites.
Insider threats are very insidious and malicious codes likeÂ Delilah could easily allow crooks to recruitÂ insiders.
âWith Trojans like Delilah, organizations should expect insider recruitment to escalate further and more rapidly. Â This will only add to the volume of insider threats caused by disgruntled employees selling their services on the Dark Web in order to harm their employers.â