{"id":7385,"date":"2023-08-31T09:34:00","date_gmt":"2023-08-31T08:34:00","guid":{"rendered":"https:\/\/www.withsecure.com\/?post_type=lab_item&p=7385"},"modified":"2026-05-22T11:44:14","modified_gmt":"2026-05-22T10:44:14","slug":"meet-the-ducks","status":"publish","type":"lab_item","link":"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/meet-the-ducks\/","title":{"rendered":"Meet the Ducks"},"content":{"rendered":"\n
\n
\n

\n Vietnamese threat groups targeting Meta Business accounts<\/span><\/h1>
\n
\n \n \n Managed Security <\/span>\n \n Threat intelligence <\/span>\n <\/span>\n \n 31 August, 2023 <\/span>\n <\/div>\n <\/div>\n <\/div>\n
\n
\n

\n Share this <\/p>\n

\n \n \n
\n
\n
\n \"\" <\/figure>\n <\/div>\n <\/div>\n<\/section>\n\n\n\n
\n
\n
\n

\n Authors <\/p>\n \n

\n
\n
\n \"\" <\/div>\n
\n

Mohammad Kazem Hassan Nejad<\/h3>\n \n

\n Senior Threat Intelligence Researcher, WithSecure <\/p>\n \n <\/div>\n\n<\/div>\n\n <\/div>\n\n <\/div>\n

\n

\n Download report\/s <\/p>\n \n

\n
\n \n Download the report
\n
\n

\n Share this story <\/p>\n

\n \n \n
\n
\n

Social media presents the biggest amalgamation of people and businesses in today\u2019s connected world, with an estimated 4.9 billion people using these services. Social media also provides organizations with a platform to engage the world around them – capabilities the majority of businesses take advantage of in one way or another.<\/p>\n

While the incentives are high for businesses to leverage social media for their own benefit, these platforms provide adversaries, with different intent and capabilities, with other opportunities. The adversarial challenges presented by these platforms are extensive, dynamic, complex, and most importantly, harmful.<\/p>\n

In this report we share an overview of current and emerging threats surrounding Meta’s ad ecosystem that are pre-dominantly originating out of Vietnam. Additionally, we will share an update on the infamous DUCKTAIL operation exposed in our previous reports\u00a0DUCKTAIL: An infostealer malware targeting Facebook Business accounts<\/a>\u00a0and\u00a0DUCKTAIL returns: Underneath the ruffled feathers<\/a>. Lastly, we will introduce an emerging threat dubbed \u201cDUCKPORT\u201d which has striking similarities to DUCKTAIL, but with important and distinct functionalities, TTPs, and history.<\/p>\n

 <\/p>\n

If you believe your business has been targeted or fallen victim to the same or similar attack and require assistance, you can reach out to our 24\/7 incident hotline\u00a0Emergency Cyber Security Incident Response | WithSecure\u2122<\/a>. If you like to collaborate on future research with WithSecure Intelligence, you may reach out at\u00a0wit-data-driven-threat-insights@withsecure.com<\/u>\u00a0.<\/p>\n<\/div>\n

\n

\n Download report\/s <\/p>\n \n

\n
\n \n Download the report
\n
\n

\n Share this story <\/p>\n

\n \n \n
\n
\n
\n
\n

\n What next?<\/span><\/h2>
\n
\n

Discover WithSecure\u2122 Elements Exposure Management.
\n– No credit card required. No obligations.No complexity.<\/p>\n<\/div>\n <\/div>\n <\/div>\n

\n Contact us<\/a> <\/div>\n <\/div> <\/div>\n <\/div>\n<\/section>\n\n\n\n\n\n
\n
\n

\n Related Labs content<\/span><\/h2>
\n
\n
\n

Find related content relating to this topic.<\/span><\/p>\n<\/div>\n <\/div>\n <\/div>\n <\/div> \n

\n
\n
\n
\n \"\"

W\/Labs<\/p>\n <\/div>\n

\n
\n
\n AI security<\/span>\n Software Protection<\/span>\n Threat intelligence<\/span>\n <\/div>\n <\/div>\n

GREYVIBE: A Russia-nexus group leveraging AI across state-aligned operations<\/h3>\n

15<\/p>\n

\n Read more<\/a> <\/div>\n <\/div>\n<\/div> <\/div>\n
\n
\n
\n \"\"

W\/Labs<\/p>\n <\/div>\n

\n

WithSecure uncovers Russia-nexus threat group using AI to target Ukraine and European organisations<\/h3>\n
\n Read more<\/a> <\/div>\n <\/div>\n<\/div> <\/div>\n
\n
\n
\n \"\"

W\/Labs<\/p>\n <\/div>\n

\n
\n
\n Attack Detection<\/span>\n Software Protection<\/span>\n Threat intelligence<\/span>\n <\/div>\n <\/div>\n

DarkGate Rises: New version of DarkGate malware hunts like a Duck but bites like a RAT<\/h3>\n

Source: https:\/\/labs.withsecure.com\/publications\/darkgate-rises<\/p>\n

\n Read more<\/a> <\/div>\n <\/div>\n<\/div> <\/div>\n <\/div>\n
\n
\n <\/div>\n
\n
\n

Social media presents the biggest amalgamation of people and businesses in today\u2019s connected world, with an estimated 4.9 billion people using these services.<\/p>\n","protected":false},"author":3,"featured_media":0,"template":"","categories":[235,269],"labs_content_type":[300],"class_list":["post-7385","lab_item","type-lab_item","status-publish","hentry","category-managed-security","category-threat-intelligence"],"acf":[],"card":"

\n
\n \"\"

W\/Labs<\/p>\n <\/div>\n

\n
\n
\n Managed Security<\/span>\n Threat intelligence<\/span>\n <\/div>\n <\/div>\n

Meet the Ducks<\/h3>\n

Social media presents the biggest amalgamation of people and businesses in today\u2019s connected world, with an estimated 4.9 billion people using these services.<\/p>\n

\n Read more<\/a> <\/div>\n <\/div>\n<\/div>","_links":{"self":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/lab_item\/7385","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/lab_item"}],"about":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/types\/lab_item"}],"author":[{"embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/users\/3"}],"wp:attachment":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/media?parent=7385"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/categories?post=7385"},{"taxonomy":"labs_content_type","embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/labs_content_type?post=7385"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}