{"id":10466,"date":"2022-07-26T11:44:00","date_gmt":"2022-07-26T10:44:00","guid":{"rendered":"https:\/\/www.withsecure.com\/resources-hub\/w-labs\/ducktail\/"},"modified":"2022-07-26T11:44:00","modified_gmt":"2022-07-26T10:44:00","slug":"ducktail","status":"publish","type":"lab_item","link":"https:\/\/www.withsecure.com\/de\/ressourcen\/w-labs\/ducktail\/","title":{"rendered":"Ducktail"},"content":{"rendered":"\n
\n
\n

\n DUCKTAIL: An infostealer malware targeting Facebook Business accounts<\/span><\/h2>
\n
\n \n \n Software Protection <\/span>\n \n Threat intelligence <\/span>\n <\/span>\n \n 26 Juli, 2022 <\/span>\n <\/div>\n <\/div>\n <\/div>\n
\n
\n

\n Teilen Sie dies <\/p>\n

\n \n \n
\n
\n
\n \"\" <\/figure>\n <\/div>\n <\/div>\n<\/section>\n\n\n\n
\n
\n
\n

\n Authors <\/p>\n \n

\n
\n
\n \"\" <\/div>\n
\n

Mohammad Kazem Hassan Nejad<\/h3>\n \n

\n Senior Threat Intelligence Researcher, WithSecure <\/p>\n \n <\/div>\n\n<\/div>\n\n <\/div>\n\n <\/div>\n

\n

\n Download report <\/p>\n \n

\n
\n \n Download
\n
\n

\n Share this story <\/p>\n

\n \n \n
\n
\n

The threat actor targets individuals and employees that may have access to a Facebook Business account with an information-stealer malware. The malware is designed to steal browser cookies and take advantage of authenticated Facebook sessions to steal information from the victim\u2019s Facebook account and ultimately hijack any Facebook Business account that the victim has sufficient access to.<\/p>\n

Based upon analysis and gathered data, we have determined that the operation is conducted by a Vietnamese threat actor. The chain of evidence suggests that the threat actor\u2019s motives are financially driven.<\/p>\n

WithSecure had shared its DUCKTAIL research prior to release with Facebook\u2019s parent company\u00a0Meta who provided the following statement:
\n\u201cWe welcome security research into the threats targeting our industry. This is a highly adversarial space and we know these malicious groups will keep trying to evade our detection. We are aware of these particular scammers, regularly enforce against them, and continue to update our systems to detect these attempts. Because this malware is typically downloaded off-platform, we encourage people to be cautious about what software they install on their devices.\u201d<\/p>\n

A full report containing detailed analysis of DUCKTAIL\u2019s malware component, recommendations and protection, as well as appendices containing indicators of compromise, detection opportunities, and MITRE ATT&CK techniques can be found in the PDF report.<\/p>\n<\/div>\n <\/div>\n <\/div>\n<\/section>\n\n\n\n

\n
\n
\n
\n

\n What next?<\/span><\/h2>
\n
\n

Discover WithSecure\u2122 Elements Exposure Management.
\n– No credit card required. No obligations.No complexity.<\/p>\n<\/div>\n <\/div>\n <\/div>\n

\n Contact us<\/a> <\/div>\n <\/div> <\/div>\n <\/div>\n<\/section>\n\n\n\n\n\n
\n
\n

\n Related Labs content<\/span><\/h2>
\n
\n
\n

Find related content relating to this topic.<\/span><\/p>\n<\/div>\n <\/div>\n <\/div>\n <\/div> \n

\n
\n
\n
\n \"\"

W\/Labs<\/p>\n <\/div>\n

\n
\n
\n Attack Detection<\/span>\n Software Protection<\/span>\n Threat intelligence<\/span>\n <\/div>\n <\/div>\n

DarkGate Rises: New version of DarkGate malware hunts like a Duck but bites like a RAT<\/h3>\n

Source: https:\/\/labs.withsecure.com\/publications\/darkgate-rises<\/p>\n

\n Mehr erfahren<\/a> <\/div>\n <\/div>\n<\/div> <\/div>\n
\n
\n
\n \"\"

W\/Labs<\/p>\n <\/div>\n

\n
\n
\n Attack Detection<\/span>\n Software Protection<\/span>\n Threat intelligence<\/span>\n <\/div>\n <\/div>\n

Reverse engineering a Lumma infection<\/h3>\n

Lumma is an information stealer that the WithSecure Detection and Response Team (DRT) have encountered several times. It has seen wider use over the past couple of years, and makes for an interesting threat to monitor.<\/p>\n

\n Mehr erfahren<\/a> <\/div>\n <\/div>\n<\/div> <\/div>\n
\n
\n
\n \"\"

W\/Labs<\/p>\n <\/div>\n

\n
\n
\n AI security<\/span>\n Attack Detection<\/span>\n Software Protection<\/span>\n <\/div>\n <\/div>\n

Machine learning-driven malware analysis<\/h3>\n

With the rapid emergence of new malware variants, accurately classifying and attributing malware samples has become more challenging than ever<\/p>\n

\n Mehr erfahren<\/a> <\/div>\n <\/div>\n<\/div> <\/div>\n <\/div>\n
\n
\n <\/div>\n
\n
\n

The threat actor targets individuals and employees that may have access to a Facebook Business account with an information-stealer malware.<\/p>\n","protected":false},"author":27,"featured_media":0,"template":"","categories":[311,312],"labs_content_type":[331],"class_list":["post-10466","lab_item","type-lab_item","status-publish","hentry","category-software-protection","category-threat-intelligence"],"acf":[],"card":"

\n
\n \"\"

W\/Labs<\/p>\n <\/div>\n

\n
\n
\n Software Protection<\/span>\n Threat intelligence<\/span>\n <\/div>\n <\/div>\n

Ducktail<\/h3>\n

The threat actor targets individuals and employees that may have access to a Facebook Business account with an information-stealer malware.<\/p>\n

\n Mehr erfahren<\/a> <\/div>\n <\/div>\n<\/div>","_links":{"self":[{"href":"https:\/\/www.withsecure.com\/de\/wp-json\/wp\/v2\/lab_item\/10466","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.withsecure.com\/de\/wp-json\/wp\/v2\/lab_item"}],"about":[{"href":"https:\/\/www.withsecure.com\/de\/wp-json\/wp\/v2\/types\/lab_item"}],"author":[{"embeddable":true,"href":"https:\/\/www.withsecure.com\/de\/wp-json\/wp\/v2\/users\/27"}],"wp:attachment":[{"href":"https:\/\/www.withsecure.com\/de\/wp-json\/wp\/v2\/media?parent=10466"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.withsecure.com\/de\/wp-json\/wp\/v2\/categories?post=10466"},{"taxonomy":"labs_content_type","embeddable":true,"href":"https:\/\/www.withsecure.com\/de\/wp-json\/wp\/v2\/labs_content_type?post=10466"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}