Gartner Blog Network


Meet Delilah – the first Insider Threat Trojan

by Avivah Litan  |  July 14, 2016  |  36 Comments

Criminal recruitment of insiders is becoming an industry now with the release of a new Trojan called “Delilah”. Delilah recruits targeted insiders via social engineering and/or extortion, sometimes using ransomware techniques. It remains a closely held Trojan not yet available on the common black market, and is only shared amongst closed hacker groups, according to threat intelligence firm Diskin Advanced Technologies (DAT).

DAT reports that the bot is delivered to victims via downloads from multiple popular adult and gaming sites. Once installed the hidden bot gathers enough personal information from the victim so that the individual can later be manipulated or extorted.  This includes information on the victim’s family and workplace. The bot comes with a social engineering plug in that connects to webcam operations so that the victim can be filmed without his or her knowledge.

Also according to DAT, instructions to victims usually involve usage of VPN services, TOR and comprehensive deletion of browser history (probably to remove audit trails).  These bots still require a high level of human involvement to identify and prioritize individuals who can be extorted into operating as insiders at desirable target organizations.  Criminals who want to use the bot can also acquire managed social engineering and fraudster services to help them out, in case they lack those specific skills.

Reportedly, the Trojan is still buggy and sometimes yields error messages when the webcam function is invoked. Infected devices are also subject to constant monitor freezing – sometimes for over ten seconds – because of the high volume of real time screen shots.  Threat actors want these bugs resolved.

Solutions

Insider threat detection and mitigation is a rich subject that we explored in a recent blog Insider threats escalate and thrive in the Dark Web . A more comprehensive research note on this topic will be published this later this Summer. Surely, to combat Delilah and similar bots, it is especially important to collect and analyze endpoint data and information on VPN usage and TOR connections. Often times, the optimal way to do this is to feed EDR output into UEBA systems for correlations and advanced analysis of various events. Organizations should also seek to prevent endpoints from getting infected in the first place by preventing employees from visiting high risk adult and gaming sites using organizational systems.

Conclusion

Insider threats are continuing to increase with active recruitment of insiders from organized criminals operating on the dark web.  With Trojans like Delilah, organizations should expect insider recruitment to escalate further and more rapidly.  This will only add to the volume of insider threats caused by disgruntled employees selling their services on the Dark Web in order to harm their employers.

 

 

Category: 

Avivah Litan
VP Distinguished Analyst
19 years at Gartner
34 years IT industry

Avivah Litan is a Vice President and Distinguished Analyst in Gartner Research. Ms. Litan's areas of expertise include endpoint security, security analytics for cybersecurity and fraud, user and entity behavioral analytics, and insider threat detection. Read Full Bio


Thoughts on Meet Delilah – the first Insider Threat Trojan


  1. Seth says:

    Avivah, you are legend.

    Thanks for the cascade of knowledge, made clear, always.

  2. […] and analyze endpoint data and information on VPN usage and TOR connections,” Litan noted in a blog post. “Often times, the optimal way to do this is to feed EDR output into UEBA systems for […]

  3. Malware Researcher says:

    Please provide a malware sample hash pls.
    The Cyber Security community need to understand 😛

  4. […] “Once installed the hidden bot gathers enough personal information from the victim so that the individual can later be manipulated or extorted,” Litan writes. […]

  5. […] to Gartner fraud analyst Avivah Litan, the malware, which is dubbed “Delilah”, has earned the title of the world’s first insider threat trojan since it allows its […]

  6. […] Delilah’ back in the 1950s, he wasn’t thinking of anything like the Trojan described by Diskin, according to Gartner’s Avivah Litan, as gathering ‘enough personal information from […]

  7. […] شركة أبحاث السوق جارتنر تقرير جديد تُشير فيه إلى قيام المُهاجمين باستخدام برمجية خبيثة […]

  8. […] شركة أبحاث السوق جارتنر تقرير جديد تُشير فيه إلى قيام المُهاجمين باستخدام برمجية خبيثة […]

  9. […] شركة أبحاث السوق جارتنر تقرير جديد تُشير فيه إلى قيام المُهاجمين باستخدام برمجية خبيثة […]

  10. […] شركة أبحاث السوق جارتنر تقرير جديد تُشير فيه إلى قيام المُهاجمين باستخدام برمجية خبيثة […]

  11. […] شركة أبحاث السوق جارتنر تقرير جديد تُشير فيه إلى قيام المُهاجمين باستخدام برمجية خبيثة […]

  12. […] “Once installed the hidden bot gathers enough personal information from the victim so that the individual can later be manipulated or extorted,” Litan writes. […]

  13. […] شركة أبحاث السوق جارتنر تقرير جديد تُشير فيه إلى قيام المُهاجمين باستخدام برمجية خبيثة […]

  14. […] شركة أبحاث السوق جارتنر تقرير جديد تُشير فيه إلى قيام المُهاجمين باستخدام برمجية خبيثة […]

  15. […] to Gartner fraud analyst Avivah Litan, the malware, which is dubbed “Delilah”, has earned the title of the world’s first insider threat trojan since it allows its […]

  16. […] شركة أبحاث السوق جارتنر تقرير جديد تُشير فيه إلى قيام المُهاجمين باستخدام برمجية خبيثة […]

  17. […] z analityków Gartnera, zajmujący się oszustwami internetowymi Avivah Litan, uznaje bezsprzecznie, że oprogramowanie o […]

  18. […] analyst Avivah Litan added, “The bot comes with a social engineering plug-in that connects to webcam operations so that […]

  19. […] to Gartner fraud analyst Avivah Litan, the malware, which is dubbed “Delilah”, has earned the title of the world’s first insider threat trojan since it allows its […]

  20. […] شركة أبحاث السوق جارتنر تقرير جديد تُشير فيه إلى قيام المُهاجمين باستخدام برمجية خبيثة […]

  21. […] شركة أبحاث السوق جارتنر تقرير جديد تُشير فيه إلى قيام المُهاجمين باستخدام برمجية […]

  22. Skeptical says:

    The tale of this malware seems very much exaggerated or perhaps entirely fictional.

    If an attacker infects an employee with malware, why extort or try to convert the victim user to an insider threat actor?

    The attackers would already have network access to the target org at this point, and that seems to be working pretty well for literally every other malware actors ever. (Dyre, Vawtrak, Carbanak, All ransomware, etc.) This is just an unnecessary step to gain information and money that makes detection far more likely.

    An employee seems just as likely to approach their tech team and say “Hey, someone is threatening to extort me through a message box on my computer.. Think I’m infected?”, rather than go along with whatever this arbitrary actor has in mind.

    Recruiting insider assets is nothing new, but for cybercrime this does not seem likely to be very successful, and the amount of effort involved even to correctly target users that can likely be turned is not a trivial matter.
    If someone has some instances where this has happened for cyber crime, I’d be very interested in the links.

    One more nitpick and I’m done: this article classifying a plugin that unknowingly records a victim on their webcam is in no way social engineering.

    Whether the analysts who researched this malware read something on a forum and simply took it face value, was directly misled by an asset, etc.. There is much more information needed there before this can be considered as a legitimate.

  23. avivah litan says:

    appreciate your skepticism but respectfully disagree. There are many different ways to infiltrate an organization and this is yet one more way. Also no one said a webcam plug-in is social engineering – it can lead to social engineering.

  24. […] analyst Avivah Litan added, “The bot comes with a social engineering plug-in that connects to webcam operations so that […]

  25. […] شركة أبحاث السوق جارتنر تقرير جديد تُشير فيه إلى قيام المُهاجمين باستخدام برمجية خبيثة […]

  26. […] “Delilah recruits targeted insiders via social engineering and/or extortion, sometimes using ransomware techniques. It remains a closely held Trojan not yet available on the common black market, and is only shared amongst closed hacker groups, according to threat intelligence firm Diskin Advanced Technologies (DAT).” Litan wrote in a blog post.  […]

  27. […] “Delilah recruits targeted insiders via social engineering and/or extortion, sometimes using ransomware techniques. It remains a closely held Trojan not yet available on the common black market, and is only shared amongst closed hacker groups, according to threat intelligence firm Diskin Advanced Technologies (DAT).” Litan wrote in a blog post.  […]

  28. […] “Delilah recruits targeted insiders via social engineering and/or extortion, sometimes using ransomware techniques. It remains a closely held Trojan not yet available on the common black market, and is only shared amongst closed hacker groups, according to threat intelligence firm Diskin Advanced Technologies (DAT).” Litan wrote in a blog post.  […]

  29. […] “Delilah recruits targeted insiders via social engineering and/or extortion, sometimes using ransomware techniques. It remains a closely held Trojan not yet available on the common black market, and is only shared amongst closed hacker groups, according to threat intelligence firm Diskin Advanced Technologies (DAT).” Litan wrote in a blog post.  […]

  30. […] شركة أبحاث السوق جارتنر تقرير جديد تُشير فيه إلى قيام المُهاجمين باستخدام برمجية خبيثة […]

  31. […] According to Gartner analyst Avivah Litan, Israeli threat intelligence firm Diskin Advanced Technologies discovered the malware, which it dubs “Delilah” and includes tools for snaring targeted insiders through social engineering and/or extortion. It could also use ransomware techniques. […]

  32. […] and analyze endpoint data and information on VPN usage and TOR connections”, Litan noted in a blog post. “Often times, the optimal way to do this is to feed EDR output into UEBA systems for […]



Comments are closed

Comments or opinions expressed on this blog are those of the individual contributors only, and do not necessarily represent the views of Gartner, Inc. or its management. Readers may copy and redistribute blog postings on other blogs, or otherwise for private, non-commercial or journalistic purposes, with attribution to Gartner. This content may not be used for any other purposes in any other formats or media. The content on this blog is provided on an "as-is" basis. Gartner shall not be liable for any damages whatsoever arising out of the content or use of this blog.