Cyber ​​espionage: Dangerous “Voldemort” malware spreads rapidly

Security researchers at Proofpoint warn of a fairly new malware called “Voldemort“The malware is currently spreading via phishing emails and uses Google Sheets as a disguise to access data and bypass security systems.

Mainly companies, businesses and organizations are the targets of the malware. The targets are mainly from the insurance, aerospace, transportation and education sectors. The actors behind the malware attack are unknown, but the security researchers at Proofpoint believe that it is a type of Cyber ​​espionage is about.

The phishing emails pretend to be tax authorities from the US, Europe or Asia. Proofpoint’s report states that the attackers design the phishing emails to match the location of the target company based on public information. The email then contains links to supposed documents of “updated tax information”.

The 8 best tax programs in comparison – Wiso, Taxfix & Co.

Up to 6000 phishing emails per day

The malware campaign started on August 5, 2024 and the attackers have already sent more than 20,000 emails to over 70 target companies. The phishing emails reach a peak day up to 6,000 potential victims.

If one of the victims clicks on the links in the emails, they are redirected to download a file disguised as a PDF, which often happens unnoticed. The malware disguises itself as network traffic and uses Google Sheets as a command-and-control server (C2). Security systems consider the malware’s communication to be harmless because it uses the Google API with embedded access data.

The malware is mainly based on Data theft Aligned, but is also able to download additional sheep software, delete files, temporarily deactivate itself and more – also serves as a kind of Backdoor and is therefore a versatile threat to infected systems.

Alarm: This hacker tool opens old security holes in Windows

How to protect yourself

To protect against this malware campaign, Proofpoint recommends restricting access from external file sharing services to trusted servers, blocking connections to TryCloudflare when they are not actively needed, and being alert for suspicious PowerShell executions.

You can read Proofpoint’s full report here.