Voldemort
Voldemort is a custom backdoor written in C. It was publicly reported by Proofpoint in August 2024 and later attributed by Proofpoint to the China-aligned threat actor TA415, which overlaps with APT41 and Brass Typhoon. The malware has also been observed in later China-aligned activity, including campaigns tracked as UNK_FistBump targeting Taiwan’s semiconductor ecosystem in 2025. Proofpoint noted that Voldemort had historically only been observed in its telemetry in TA415-linked activity prior to that later overlap.
Observed delivery has primarily been via phishing campaigns. In the August 2024 activity, tax-themed phishing emails impersonating government tax authorities targeted more than 70 organizations globally across the U.S., Europe, and Asia. The infection chain used Google AMP Cache and InfinityFree landing pages, redirected Windows users to TryCloudflare-hosted WebDAV content via search-ms abuse, and delivered malicious LNK files. Executing the LNK launched PowerShell to run Python from the remote WebDAV share, collected host information, downloaded a decoy PDF, then retrieved a password-protected ZIP from OpenDrive containing CiscoCollabHost.exe and a malicious CiscoSparkLauncher.dll. CiscoCollabHost.exe, a legitimate WebEx-related executable, was abused to sideload the DLL payload tracked as Voldemort. Later campaigns also used employment-themed phishing and password-protected archives, including late-May 2025 activity where CiscoCollabHost.exe again sideloaded CiscoSparkLauncher.dll to deliver Voldemort.
Voldemort supports host reconnaissance, file operations, command execution, and loading or dropping additional payloads. Reported commands include Ping, Dir, Download, Upload, Exec, Copy, Move, Sleep, and Exit. Proofpoint assessed that Cobalt Strike was likely one of the payloads delivered by Voldemort, and separate reporting described campaigns that delivered either Cobalt Strike Beacon or Voldemort. The malware uses dynamic API resolution, a roughly 5 to 10 minute jittered sleep, and a nonstandard XTEA-like string decryption routine. Its configuration is decrypted by egg-hunting for the marker "g00" and XOR-decrypting the configuration using the executable name CiscoCollabHost.exe. Variants observed in 2025 exfiltrated host information to Google Sheets, with later variants Base64-encoding and RC4-encrypting values using CiscoCollabHost.exe as the RC4 key.
For command and control, Voldemort uses Google Sheets via the Google Sheets API, and related storage functionality uses Google Drive. Proofpoint reported that the malware authenticated using embedded Google API client credentials and a refresh token. This use of legitimate cloud services for C2 is a defining characteristic repeatedly noted in reporting. Proofpoint also observed actor Google Drive content associated with the campaign, including a password-protected archive named Test.7z containing Shuaruta.exe and a Go-based nvdaHelperRemote.dll that loaded a Cobalt Strike Beacon.
Targeting associated with Voldemort includes broad global espionage-oriented phishing against 18 industry verticals in 2024, with insurance organizations comprising nearly a quarter of targeted entities, and additional targeting of aerospace, transportation, universities, chemicals, manufacturing, and insurance. In 2025, Voldemort was used in China-aligned campaigns against Taiwan’s semiconductor design, packaging, manufacturing, and supply chain organizations, including HR and recruiting personnel, as well as related ecosystem targets. Reporting consistently assessed the activity as espionage and intelligence gathering rather than financially motivated.
Known indicators and artifacts mentioned in reporting include the sideloading pair CiscoCollabHost.exe and CiscoSparkLauncher.dll; exported names such as Voldemort_gdrive_dll.dll and later Voldemort_gdrive_c.dll; Google Sheets API activity; Google Drive usage; and campaign infrastructure involving InfinityFree, TryCloudflare, OpenDrive, and tracking to 83.147.243.18 via pingb.in paths such as /stage0 and /stage1. Proofpoint also published Emerging Threats signatures for Google Sheets API activity and Voldemort system information exfiltration, including signature IDs 2857963, 2857964, 2857976, and 2858210.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Proofpoint researchers identified an unusual campaign delivering malware that the threat actor named “Voldemort”. ... Voldemort is a custom backdoor written in C. It has capabilities for information gathering and to drop additional payloads.
Proofpoint researchers identified an unusual campaign delivering malware that the threat actor named “Voldemort”. ... Voldemort is a custom backdoor written in C. It has capabilities for information gathering and to drop additional payloads.
...shifted to delivery of the custom Voldemort backdoor in late May 2025... executes ... CiscoCollabHost.exe ... loads ... CiscoSparkLauncher.dll... delivery of the custom Voldemort backdoor, which uses Google Sheets for command and control (C2).
Techniques & procedures
23 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique
Resource Development
Initial Access
2 techniques
Initial Access
Chinese state-aligned hackers have ramped up espionage efforts against Taiwan's semiconductor ecosystem through spear-phishing campaigns... UNK_FistBump used job-themed lures, posing as graduate students applying for positions. The attackers sent phishing emails from compromised Taiwanese university email accounts to HR and recruiting teams at semiconductor companies. Attached documents led to malware-laced ZIP or PDF files hosted on file-sharing platforms such as Zendesk and Filemail.
Execution
6 techniques
Execution
The commands the malware supports are as follows: Ping Dir Download Upload Exec Copy Move Sleep Exit
If the LNK is executed, it will invoke PowerShell to run Python.exe from a third WebDAV share on the same tunnel (\library\), passing a Python script on a fourth share (\resource\) on the same host as an argument.
“...runs a VBS script Store.vbs…” / “Execution… runs another VBS file also called Store.vbs…”
This causes Python to run the script without downloading any files to the computer, with dependencies being loaded directly from the WebDAV share.
Stealth
6 techniques
Stealth
To decrypt strings, the malware relies on an algorithm that looks very similar to XTEA... With API calls resolved, the malware continues by decrypting its own configuration... decrypted via an XOR cipher using the executable name “CiscoCollabHost.exe”.
The malware then has a routine to dynamically invoke APIs that is relatively unique. To resolve functions and call them, the malware passes a DLL handle, a callback to a function, and the arguments to the function it’s trying to call.
It also uses a PDF icon to masquerade as a different file type. These two techniques may lead the recipient to believe it is a local PDF file, which may increase the likelihood of clicking on the content.
“...decrypts the RC4-encrypted Cobalt Strike Beacon payload from the rc4.log file using the key qwxsfvdtv…” / “...Base64-encoded and RC4-encrypted… using… CiscoCollabHost.exe as the RC4 key…” / “...payload which is XOR encoded with the key mysecretkey.”
Discovery
2 techniques
Discovery
Collection
1 technique
Collection
Command and Control
5 techniques
Command and Control
The malware used DLL sideloading techniques and, in some cases, Google Sheets as a command-and-control channel... The malware communicated with C2 servers over TCP port 465 using FakeTLS and XOR encryption.
Rather than using dedicated infrastructure or even compromised infrastructure, the malware utilizes Google Sheets infrastructure for C2, data exfiltration and executing commands from the operators.
The malware used DLL sideloading techniques and, in some cases, Google Sheets as a command-and-control channel.
The exploited site delivered a malware payload, which we have dubbed “TOUGHPROGRESS”, that took advantage of Google Calendar for command and control (C2). Misuse of cloud services for C2 is a technique that many threat actors leverage in order to blend in with legitimate activity.
This will result in displaying a Windows shortcut file... hosted on the same TryCloudflare host, but in another WebDAV share, \pub\. ... If the LNK is executed, it will invoke PowerShell to run Python.exe from a third WebDAV share on the same tunnel (\library\), passing a Python script on a fourth share (\resource\). | Voldemort is a backdoor with capabilities for information gathering and can load additional payloads. Proofpoint observed Cobalt Strike hosted on the actor's infrastructure, and it is likely that is one of the payloads that would be delivered.
IOCs tracked for this family
62 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Backdoor referenced as previously seen in Chinese-nexus campaigns (mentioned as historical context).
Backdoor referenced as previously delivered in China-aligned campaigns (no additional functional details provided in the content).
Custom backdoor previously delivered by TA415 in phishing campaigns before the group shifted to using VS Code Remote Tunnels.
Voldemort is a custom backdoor malware that uses Google Sheets as a command and control (C2) channel, allowing attackers to communicate with infected hosts in a stealthy manner.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.