Welcome to WithSecure Labs - Cyber security research and development

With Great Research Comes Great Responsibility.

Welcome to our research and development platform: WithSecure Labs. Here we dissect industry news and trends, publish research, and share our tools with the security community.

DUCKTAIL: An infostealer malware targeting Facebook Business accounts

By Mohammad Kazem Hassan Nejad on 26 July, 2022

WithSecure™ has discovered an ongoing operation (dubbed "DUCKTAIL") that targets individuals and organizations that operate on Facebook’s Business and Ads platform.

The threat actor targets individuals and employees that may have access to a Facebook Business account with an information-stealer malware. The malware is designed to steal browser cookies and take advantage of authenticated Facebook sessions to steal information from the victim's Facebook account and ultimately hijack any Facebook Business account that the victim has sufficient access to.

Based upon analysis and gathered data, we have determined that the operation is conducted by a Vietnamese threat actor. The chain of evidence suggests that the threat actor’s motives are financially driven.

A full report containing detailed analysis of DUCKTAIL’s malware component, recommendations and protection, as well as appendices containing indicators of compromise, detection opportunities, and MITRE ATT&CK techniques can be found in the PDF report.

With Great Research Comes Great Responsibility.

DUCKTAIL: An infostealer malware targeting Facebook Business accounts

Rethinking Credential Theft

Publications

DUCKTAIL: An infostealer malware targeting Facebook Business accounts

Printing Shellz

Threat Intelligence Report: Lazarus Group Campaign Targeting the Cryptocurrency Vertical

Detectree: Detection Visualisation for Blue Teams

The Fake Cisco

Tools

Latest Tools

Detectree: Detection Visualisation for Blue Teams

Metasploit Modules for RCE in Apache NiFi and Kong API Gateway

awspx

var/log/messages

Spoofing Call Stacks To Confuse EDRs

Scheduled Task Tampering

Faking Another Positive COVID Test

Detecting Attacks against Azure DevOps

Faking A Positive COVID Test