Voldemort Malware: Hybrid Espionage Exploits Google Sheets & Trusted Platforms

This Threat Research explores the underlying intricacies of the Voldemort malware campaign, a highly sophisticated cyber-espionage operation. Designed for Malware Researchers, Security Analysts, CISOs, and CSOs, this analysis delves into Voldemort’s use of trusted services, multi-vector attacks, and its ability to blend cybercrime and espionage techniques.

Key to the campaign is its abuse of Google Sheets for Command and Control (C2) communications, masking its malicious activities behind trusted services. Furthermore, Voldemort uses DLL side-loading via legitimate Cisco WebEx executables and advanced fileless techniques, emphasizing the threat it poses to modern enterprises.

Scope

The Voldemort malware targets a broad range of industries including insurance, aerospace, transportation, and education, combining espionage with cybercrime techniques.

This Threat Research & Analysis addresses:

Phishing Techniques: Detailing how Voldemort used language-customized phishing lures impersonating tax authorities.
C2 via Legitimate Platforms: Explaining the operational stealth of using Google Sheets for command communication and data exfiltration.
DLL Side-loading and Exploits: Investigating how Voldemort leverages legitimate software vulnerabilities.
Espionage and Cybercrime Convergence: Analyzing the blending of cybercriminal and nation-state espionage tactics.

Voldemort as a Hybrid Threat

The Voldemort malware combines cybercrime and espionage, using familiar techniques such as phishing while incorporating sophisticated evasion tactics like cloud-based C2 infrastructure. This hybridization is what makes Voldemort an unprecedented threat.

Screenshot 2024-08-29 at 10.48.18 AM.png

*sectors Voldemort malware email campaigns have been active (proofpoint)*

Campaign Overview: Voldemort Malware

Campaign Start and Phishing Volume

Voldemort’s first detection occurred on August 5, 2024, escalating rapidly with 20,000 phishing emails sent by mid-August. The campaign’s phishing emails targeted more than 70 organizations globally in industries like insurance and aerospace, pointing to potential industrial espionage.

Phishing Lures and Techniques

Impersonation Strategy: Phishing emails impersonated tax authorities, such as IRS (US) and HMRC (UK), using authentic sender domains to bypass basic security controls.
Custom Language Phishing: Emails were customized based on the region, targeting victims in their native language, further adding to their legitimacy.
Embedded URLs: Phishing emails included Google AMP Cache URLs, redirecting victims to InfinityFree hosted landing pages that delivered malicious payloads.

Screenshot 2024-08-29 at 10.49.26 AM.png

*InfinityFree hosted landing page*

Initial Attack Chain and Exploits

Phishing Email Components: Clicking the malicious link triggered a search-ms URI download, masking malicious LNK or ZIP files as legitimate PDF documents.
C2 via Google Sheets: Google Sheets was used as the primary C2, allowing Voldemort to exfiltrate data and receive commands without triggering alarms.

Mid-Campaign Spike and Evolution

The campaign intensified on August 17, 2024, with a peak of 6,000 phishing emails in one day. As the campaign progressed, attackers evolved their delivery techniques, using obfuscated payloads and TryCloudflare tunnels for hosting malicious components.

Technical Features of Voldemort Malware

Backdoor Capabilities: Command Execution and Payload Delivery

At its core, Voldemort uses a C-based backdoor to execute espionage activities, such as data exfiltration and command execution. The malware initially deploys via a phishing link that triggers search-ms URI exploitation, launching fileless Python scripts to avoid detection. These scripts gather detailed system information using platform.uname().

Exfiltration: Data is base64 encoded and sent via encrypted requests to the C2 server.
Follow-up Payloads: Voldemort’s backdoor exploits legitimate software like Cisco WebEx to deliver secondary payloads using DLL side-loading.

Command and Control via Google Sheets

Voldemort’s most unique feature is its use of Google Sheets for C2 communications. This allows the malware to stay under the radar by communicating through trusted cloud platforms. Each infected machine is assigned a UUID, which it uses to interact with designated cells in the Google Sheet, executing commands or exfiltrating data.

Why Hard to Detect: Traditional firewalls and IDS typically whitelist Google services, making it difficult for defenders to identify this anomalous behavior.

DLL Side-Loading and Fileless Execution

Voldemort’s DLL side-loading exploits CiscoCollabHost.exe, loading its malicious DLL to execute under the guise of a trusted process. Combined with fileless execution using PowerShell and Python scripts from WebDAV shares, this strategy allows Voldemort to bypass endpoint protection systems.

Key Command Set

Ping: Tests connectivity to C2 servers.
Dir: Retrieves directory listings for further exploration.
Download/Upload: Facilitates file exfiltration and payload deployment.
Exec: Executes commands remotely, giving full control over the infected machine.

Post-Exploitation and Persistence

Voldemort uses scheduled tasks to maintain persistence, ensuring its backdoor remains active after reboots. Additionally, the malware’s backdoor includes a delayed execution mechanism to avoid sandbox analysis.

Espionage Motivation and Attribution

Voldemort’s campaign exhibits characteristics of Advanced Persistent Threats (APTs), focusing on espionage rather than financial gain. The malware targets high-value sectors like aerospace and insurance, which suggests state-sponsored motivations.

Blurring Cybercrime and Espionage

While Voldemort employs cybercriminal tactics, such as phishing, its long-term data collection and intelligence-gathering capabilities point to espionage objectives. The blending of techniques makes it difficult to attribute to a specific threat actor.

Indicators of Compromise (IoCs)

Phishing URLs and Redirect Mechanisms

Key phishing URLs hosted on InfinityFree and Google AMP Cache are primary indicators of compromise. These URLs often redirect victims to landing pages containing malicious files.

Examples:
`hxxps://pubs[.]infinityfreeapp[.]com/IRS_P966[.]html`
`hxxps://resource[.]infinityfreeapp[.]com/ABC_of_Tax[.]html`

Malicious File Hashes

Monitoring file hashes such as CiscoSparkLauncher.dll and test.zip can help identify and block malicious files.

CiscoSparkLauncher.dll Hash: `561e15a46f474255fda693afd644c8674912df495bada726dbe7565eae2284fb`

IP Addresses: WebDAV and TryCloudflare Tunnels

WebDAV shares and TryCloudflare tunnels were used for payload delivery and command execution.

Key IP: `83[.]147[.]243[.]18`

Defensive Measures and Recommendations

Monitor Google Sheets Traffic

Monitoring for anomalous traffic to Google Sheets is essential. Any unusual volume of data transferred or repeated connections from the same machine should raise alerts.

Restrict External File Access

Restrict access to unnecessary external file-sharing services like WebDAV and TryCloudflare to prevent fileless execution.

Implement Behavioral Detection

Since Voldemort relies on fileless execution, behavioral-based detection is critical. Monitoring PowerShell and API calls for anomalies can reveal malware attempting to execute scripts from remote sources.

Conclusion: Comprehensive Analysis of Voldemort Malware

The Voldemort malware campaign represents an evolution in cyber-espionage, merging cybercriminal and nation-state tactics. Its abuse of trusted platforms like Google Sheets introduces new challenges for defenders. As malware continues to leverage cloud-based infrastructure and fileless execution, security teams must evolve their defenses to monitor trusted services and detect anomalous behaviors early.