Voldemort Hackers Exploit Google Sheets to Target Windows Users

Proofpoint researchers have uncovered a cyberattack campaign, “Voldemort,” using Google Sheets as a C2 platform. Targeting Windows users, the campaign employs a unique attack chain with both common and rare techniques to deliver custom malware, highlighting significant cybersecurity challenges.

Voldemort Campaign

Proofpoint researchers discovered a unique attack campaign using Google Sheets for C2 operations. The custom backdoor malware, dubbed “Voldemort,” is written in C and can gather information and deploy additional payloads. The campaign employs sophisticated techniques, making it stand out in the threat landscape.

The campaign, starting on August 5, 2024, sent over 20,000 malicious emails to more than 70 organizations globally.

Threat actors impersonated tax authorities from countries like the U.S., UK, France, and others, using compromised domains to make the phishing attempts appear more authentic.

The emails included links to a landing page on InfinityFree. Clicking “View Document” checked for a Windows environment, then redirected users to a TryCloudflare-tunneled link, which opened Windows Explorer. This trick made the malware appear as a local PDF file, encouraging user interaction.

The Voldemort campaign uses the Windows search protocol (search-ms) to make remote files appear local. This method, often used for deploying RATs, is gaining popularity among cybercriminals and includes saved search file formats (.search-ms) to further hide malicious actions.

Execution and Payload Delivery

If the victim runs the malicious LNK file, it executes a PowerShell command to run Python.exe from a WebDAV share, executing a script that collects system information and sends it to the attacker.

The malware also downloads a fake PDF and a password-protected ZIP file, extracting and running a legitimate executable that is vulnerable to DLL hijacking.

The Use of Google Sheets for Command and Control

Instead of relying on traditional or compromised servers, the Voldemort malware uses Google Sheets for command and control (C2), data exfiltration, and executing commands. By using a client token for authentication, the malware reads and writes data on Google Sheets, making it a communication channel with the attackers. It supports various commands for file and system operations, and reports back with status updates, including the malware’s name, “Voldemort.”

Implications and Risks

Proofpoint believes with moderate confidence that the Voldemort campaign is driven by an advanced persistent threat (APT) actor focused on intelligence gathering. However, its scale and targeting suggest a mix of espionage and cybercriminal activities.

Using cloud services like Google Sheets for malicious purposes reflects a troubling trend. It enables attackers to exploit legitimate infrastructure, complicating detection and response efforts for cybersecurity professionals.

The Voldemort campaign shows an advanced use of cloud services in cyberattacks. As threats evolve, cybersecurity professionals must enhance defenses and stay aware of how legitimate tools can be misused.

Indicators of compromise 

‍Follow Us on: Twitter, Instagram, Facebook to get the latest security news!