Revisiting Voldemort, HealthKick, and GOVERSHELL: A Technical Retrospective

This report analyzes three interrelated espionage toolsets—Voldemort, HealthKick (GOVERSHELL v1), and GOVERSHELL v2–v5—used from mid‑2024 to late‑2025 against Taiwanese semiconductor firms and international think tanks, detailing their spear‑phishing delivery chains, DLL sideloading persistence, diverse C2 mechanisms (notably Google Sheets as C2 for Voldemort, double‑fake TLS for HealthKick, and evolving HTTP/WebSocket/AES schemes for GOVERSHELL), signs of LLM-assisted development, and recommendations to validate defenses using the Picus Security Validation Platform.