DUCKTAIL: An infostealer targeting Facebook Business accounts

A report has been published by cybersecurity firm, WithSecure Intelligence, on an operation that targets individuals and businesses that operate on Facebook’s advertising platform and hijacking them through its website and social media platform.

REFERENCES: https://labs.withsecure.com/content/dam/labs/docs/WithSecure_Research_DUCKTAIL.pdf

https://github.com/WithSecureLabs/iocs/blob/master/DUCKTAIL/iocs.csv

TAGS: ducktail, infostealer, businesses hijack

MALWARE FAMILY: DUCKTAIL

ATT&CK IDS: T1591 - Gather Victim Org Information, T1589 - Gather Victim Identity Information, T1593 - Search Open Websites/Domains, T1586 - Compromise Accounts, T1587 - Develop Capabilities, T1588 - Obtain Capabilities, T1566 - Phishing, T1204 - User Execution, T1555 - Credentials from Password Stores, T1539 - Steal Web Session Cookie, T1102 - Web Service, T1567 - Exfiltration Over Web Service

Read More:

https://otx.alienvault.com/pulse/6380b7df615a70ddb2369653