Ducktail infostealer malware targets Facebook Business accounts

guest · Jul 26, 2022

Newly uncovered Ducktail operation targets individuals with access to Facebook Business service and tries to steal their accounts
July 26, 2022

Employees with access to their organisation’s Facebook Business accounts should be on guard against hijacking attempts by a newly uncovered threat actor, dubbed Ducktail, according to research released today by researchers at WithSecure (formerly F-Secure).

WithSecure has been tracking Ducktail for some time and believes the group has been actively developing and distributing its malware for almost a year. The financially motivated gang appears to be based in Vietnam, and is targeting individuals and organisations operating on Facebook’s Ads and Business platform with spear-phishing emails.
Click to expand...

Its modus operandi is to conduct research on individuals likely to have access to a Facebook Business account on LinkedIn, and then conducting spear-phishing attacks against those likely to have admin privileges.

“We believe that the Ducktail operators carefully select a small number of targets to increase their chances of success and remain unnoticed,” said Mohammad Kazem Hassan Nejad, a researcher and malware analyst at WithSecure Intelligence.
“We have observed individuals with managerial, digital marketing, digital media, and human resources roles in companies to have been targeted.
Click to expand...

WithSecure: DUCKTAIL: An infostealer malware targeting Facebook Business accounts

WithSecure™ has discovered an ongoing operation (dubbed "DUCKTAIL") that targets individuals and organizations that operate on Facebook’s Business and Ads platform.

The threat actor targets individuals and employees that may have access to a Facebook Business account with an information-stealer malware. The malware is designed to steal browser cookies and take advantage of authenticated Facebook sessions to steal information from the victim's Facebook account and ultimately hijack any Facebook Business account that the victim has sufficient access to.
Click to expand...

Based upon analysis and gathered data, we have determined that the operation is conducted by a Vietnamese threat actor. The chain of evidence suggests that the threat actor’s motives are financially driven.
Click to expand...

guest · Nov 23, 2022

Ducktail Cyberattackers Add WhatsApp to Facebook Business Attack Chain
By Jai Vijayan @jaivijayan - November 22, 2022

A financially motivated threat actor targeting individuals and organizations on Facebook's Ads and Business platform has resumed operations after a brief hiatus, with a new bag of tricks for hijacking accounts and profiting from them.
Click to expand...

Evolving Tactics
WithSecure spotted Ducktail's activity earlier this year and disclosed details of its tactics and techniques in a July blog post. The disclosure forced Ducktail's operators to suspend operations briefly while they devised new methods for continuing with their campaign.

In September, Ducktail resurfaced with changes to the way it operates and to its mechanisms for evading detection. Far from slowing down, the group appears to have expanded its operations, onboarding multiple affiliate groups to its campaign, WithSecure said in a report on Nov. 22.
Click to expand...

In addition to using LinkedIn as an avenue for spear-phishing targets, as it did in previous campaigns, the Ducktail group has now begun using WhatsApp for targeting users as well. The group has also tweaked the capabilities of its primary information stealer and has adopted a new file format for it, to evade detection.

"We believe the Ducktail operation uses hijacked business account access purely to make money by pushing out fraudulent ads," says Mohammad Kazem Hassan Nejad, a researcher at WithSecure Intelligence.
Click to expand...

WithSecure: DUCKTAIL returns: Underneath the ruffled feathers

By Mohammad Kazem Hassan Nejad - November 22, 2022
The operation ultimately hijacks Facebook Business accounts to which the victim has sufficient access. The threat actor uses their gained access to run ads for monetary gain.

After a short hiatus, the DUCKTAIL campaign returned with slight changes in their mode of operation. In this report, we’ll discuss what we have discovered since our original analysis was published.
You may find additional information about DUCKTAIL in our first report available at: https://labs.withsecure.com/publications/ducktail
Click to expand...

Log in or Sign up

Ducktail infostealer malware targets Facebook Business accounts

guest Guest

guest Guest

Log in or Sign up

Ducktail infostealer malware targets Facebook Business accounts

guest Guest

guest Guest

Useful Searches