Voldemort
Voldemort is a custom backdoor observed in China-aligned espionage campaigns. Reporting in the provided content links its use to TA415, a cluster overlapping with APT41 / Brass Typhoon / Wicked Panda, and also to a distinct China-aligned cluster tracked by Proofpoint as UNK_FistBump. It was delivered in phishing campaigns, including employment-themed lures targeting Taiwan’s semiconductor ecosystem and earlier campaigns against other sectors. In Proofpoint reporting, campaigns initially delivered Cobalt Strike Beacon and later shifted to Voldemort, including activity in August 2024 and a renewed shift to Voldemort in late May 2025.
A defining characteristic of Voldemort is its use of Google Sheets, via the Google Sheets API, for command and control. Proofpoint noted variants that exfiltrated host information to Google Sheets, including one May 2025 variant that sent host data in plaintext and a later variant that Base64-encoded and RC4-encrypted values using CiscoCollabHost.exe as the RC4 key. The malware was delivered through DLL sideloading chains; one documented chain executed CiscoCollabHost.exe to load CiscoSparkLauncher.dll and install the backdoor. Separate reporting also references China-aligned activity abusing the NVDA component nvdaHelperRemote.dll in campaigns associated with Voldemort-related activity.
The malware has been used against semiconductor design, packaging, manufacturing, testing, and supply-chain organizations in Taiwan, as well as HR and recruiting personnel at those firms. Proofpoint assessed the broader campaigns as espionage-motivated and tied to China’s strategic interest in semiconductor intelligence and self-sufficiency. High-confidence associations in the content include phishing delivery, DLL sideloading, Google Sheets-based C2, overlap with TA415/APT41-linked tradecraft, and use by UNK_FistBump in campaigns that also deployed Cobalt Strike.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Following multiple phishing campaigns resulting in the delivery of the Voldemort backdoor in August 2024, Proofpoint observed TA415 shift tactics, techniques and procedures (TTPs) and adopt the use of VS Code Remote Tunnels.
Following multiple phishing campaigns resulting in the delivery of the Voldemort backdoor in August 2024, Proofpoint observed TA415 shift tactics, techniques and procedures (TTPs) and adopt the use of VS Code Remote Tunnels.
...shifted to delivery of the custom Voldemort backdoor in late May 2025... executes ... CiscoCollabHost.exe ... loads ... CiscoSparkLauncher.dll... delivery of the custom Voldemort backdoor, which uses Google Sheets for command and control (C2).
Techniques & procedures
9 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniquesChinese state-aligned hackers have ramped up espionage efforts against Taiwan's semiconductor ecosystem through spear-phishing campaigns... UNK_FistBump used job-themed lures, posing as graduate students applying for positions. The attackers sent phishing emails from compromised Taiwanese university email accounts to HR and recruiting teams at semiconductor companies. Attached documents led to malware-laced ZIP or PDF files hosted on file-sharing platforms such as Zendesk and Filemail.
Throughout July and August 2025, TA415 conducted spearphishing campaigns targeting United States government, think tank, and academic organizations utilizing U.S.-China economic-themed lures.
Execution
3 techniques“...runs a VBS script Store.vbs…” / “Execution… runs another VBS file also called Store.vbs…”
“Execution of the… LNK file… runs a VBS script… [and] opens a decoy document…” / “Upon execution… scheduled task… created…”
“These infection chains were initially triggered by distinct Microsoft Shortcut (LNK) files.” / “... [PDF] Introduction Document-2025.4.25.lnk”
Stealth
1 technique“...decrypts the RC4-encrypted Cobalt Strike Beacon payload from the rc4.log file using the key qwxsfvdtv…” / “...Base64-encoded and RC4-encrypted… using… CiscoCollabHost.exe as the RC4 key…” / “...payload which is XOR encoded with the key mysecretkey.”
Command and Control
3 techniquesThe malware used DLL sideloading techniques and, in some cases, Google Sheets as a command-and-control channel... The malware communicated with C2 servers over TCP port 465 using FakeTLS and XOR encryption.
The malware used DLL sideloading techniques and, in some cases, Google Sheets as a command-and-control channel.
The malware used DLL sideloading techniques and, in some cases, Google Sheets as a command-and-control channel.
IOCs tracked for this family
14 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Backdoor referenced as previously seen in Chinese-nexus campaigns (mentioned as historical context).
Backdoor referenced as previously delivered in China-aligned campaigns (no additional functional details provided in the content).
Custom backdoor previously delivered by TA415 in phishing campaigns before the group shifted to using VS Code Remote Tunnels.
Voldemort is a custom backdoor malware that uses Google Sheets as a command and control (C2) channel, allowing attackers to communicate with infected hosts in a stealthy manner.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.