Researchers have identified an attack that impersonates tax authorities from several countries to compromise organizations and deploy a custom backdoor program dubbed Voldemort. While the campaign uses tactics seen in financially motivated cybercrime attacks, the researchers believe the true purpose is likely espionage based on the characteristics of the deployed malware.

The campaign’s targeting is unusual for an advanced persistent threat (APT) because it involved more than 20,000 phishing messages in a variety of languages impacting over 70 organizations globally. Impersonated tax agencies included the US Internal Revenue Service, the UK’s HM Revenue & Customs, France’s Direction Générale des Finances Publiques, Germany’s Bundeszentralamt für Steuern, Italy’s Agenzia delle Entrate, India’s Income Tax Department, and Japan’s National Tax Agency. The latter two were observed in a later wave of attacks, suggesting the campaign is growing and adding more languages.

Targeted organizations span 18 verticals, with insurance being the top target, accounting for nearly a quarter. Aerospace, transportation, education, and finance followed in the ranking.