Blog post

Meet Delilah – the first Insider Threat Trojan

By Avivah Litan | July 14, 2016 | 4 Comments

Criminal recruitment of insiders is becoming an industry now with the release of a new Trojan called “Delilah”. Delilah recruits targeted insiders via social engineering and/or extortion, sometimes using ransomware techniques. It remains a closely held Trojan not yet available on the common black market, and is only shared amongst closed hacker groups, according to threat intelligence firm Diskin Advanced Technologies (DAT).

DAT reports that the bot is delivered to victims via downloads from multiple popular adult and gaming sites. Once installed the hidden bot gathers enough personal information from the victim so that the individual can later be manipulated or extorted.  This includes information on the victim’s family and workplace. The bot comes with a social engineering plug in that connects to webcam operations so that the victim can be filmed without his or her knowledge.

Also according to DAT, instructions to victims usually involve usage of VPN services, TOR and comprehensive deletion of browser history (probably to remove audit trails).  These bots still require a high level of human involvement to identify and prioritize individuals who can be extorted into operating as insiders at desirable target organizations.  Criminals who want to use the bot can also acquire managed social engineering and fraudster services to help them out, in case they lack those specific skills.

Reportedly, the Trojan is still buggy and sometimes yields error messages when the webcam function is invoked. Infected devices are also subject to constant monitor freezing – sometimes for over ten seconds – because of the high volume of real time screen shots.  Threat actors want these bugs resolved.


Insider threat detection and mitigation is a rich subject that we explored in a recent blog Insider threats escalate and thrive in the Dark Web . A more comprehensive research note on this topic will be published this later this Summer. Surely, to combat Delilah and similar bots, it is especially important to collect and analyze endpoint data and information on VPN usage and TOR connections. Often times, the optimal way to do this is to feed EDR output into UEBA systems for correlations and advanced analysis of various events. Organizations should also seek to prevent endpoints from getting infected in the first place by preventing employees from visiting high risk adult and gaming sites using organizational systems.


Insider threats are continuing to increase with active recruitment of insiders from organized criminals operating on the dark web.  With Trojans like Delilah, organizations should expect insider recruitment to escalate further and more rapidly.  This will only add to the volume of insider threats caused by disgruntled employees selling their services on the Dark Web in order to harm their employers.



The Gartner Blog Network provides an opportunity for Gartner analysts to test ideas and move research forward. Because the content posted by Gartner analysts on this site does not undergo our standard editorial review, all comments or opinions expressed hereunder are those of the individual contributors and do not represent the views of Gartner, Inc. or its management.

Comments are closed


  • Seth says:

    Avivah, you are legend.

    Thanks for the cascade of knowledge, made clear, always.

  • Malware Researcher says:

    Please provide a malware sample hash pls.
    The Cyber Security community need to understand 😛

  • Skeptical says:

    The tale of this malware seems very much exaggerated or perhaps entirely fictional.

    If an attacker infects an employee with malware, why extort or try to convert the victim user to an insider threat actor?

    The attackers would already have network access to the target org at this point, and that seems to be working pretty well for literally every other malware actors ever. (Dyre, Vawtrak, Carbanak, All ransomware, etc.) This is just an unnecessary step to gain information and money that makes detection far more likely.

    An employee seems just as likely to approach their tech team and say “Hey, someone is threatening to extort me through a message box on my computer.. Think I’m infected?”, rather than go along with whatever this arbitrary actor has in mind.

    Recruiting insider assets is nothing new, but for cybercrime this does not seem likely to be very successful, and the amount of effort involved even to correctly target users that can likely be turned is not a trivial matter.
    If someone has some instances where this has happened for cyber crime, I’d be very interested in the links.

    One more nitpick and I’m done: this article classifying a plugin that unknowingly records a victim on their webcam is in no way social engineering.

    Whether the analysts who researched this malware read something on a forum and simply took it face value, was directly misled by an asset, etc.. There is much more information needed there before this can be considered as a legitimate.

  • avivah litan says:

    appreciate your skepticism but respectfully disagree. There are many different ways to infiltrate an organization and this is yet one more way. Also no one said a webcam plug-in is social engineering – it can lead to social engineering.