DuckTail

We have analyzed a recent campaign that ran between March and early October 2023 and targeted marketing professionals.

MITRE ATT&CK Matrix ... T1598.002 Phishing for Information: Spearphishing Attachment

threat actors also registered many custom domains through Rebrandly, spreading shortened links with their own fake company name domains

Malicious archives are often hosted on public cloud hosting services like iCloud, Google Drive, Dropbox, Transfer.sh, and OneDrive... threat actors use Trello... as a cloud hosting service

T1587.001 Develop Capabilities: Malware DUCKTAIL custom .NET malware

Threat actor created fake organizations and received certificates for them while signing malware.

Ad account theft, the systematic hijacking of Meta Business Manager and Google Ads accounts, has grown into a commodity-driven cybercrime economy... Legitimate ad spend history raises account trust scores, meaning aged, active accounts can serve ads that pass platform safety checks that would reject a new attacker-created account.

Our team also observed cases where threat actors sent infected archive links through email, after making initial contact on LinkedIn. The image below shows a spear phishing email example.

The campaign saw the bad actor send out an archive containing images of new products by bona fide companies along with a malicious executable disguised with a PDF icon.

T1566 .002 Phishing: Spearphishing Link Threat actor posted links to archives with malicious LNK files on Reddit

DuckTail primarily reaches victims by posting fake marketing-related job listings on LinkedIn... Once a potential victim responds to a bait post, the “recruiter” will send a message on LinkedIn.

Type 2 Archive - .lnk files with PowerShell payloads, plus .scr executables, both obscured by double extensions (.pdf.lnk, .docx.scr)

While the script stands by, the parent executable saves a malicious library named libEGL.dll to C:\Users\Public\Libraries\ and then loads it.

The initial infection starts with a malicious LNK that executes PowerShell to download malware hosted on a public file-sharing service.

Ad account theft, the systematic hijacking of Meta Business Manager and Google Ads accounts, has grown into a commodity-driven cybercrime economy... Legitimate ad spend history raises account trust scores, meaning aged, active accounts can serve ads that pass platform safety checks that would reject a new attacker-created account.

Attackers who gain access often add their own admins and downgrade the legitimate owner to a limited role, something platform permission structures don’t always let a newly added admin reverse.

The malware would install a browser extension capable of stealing Facebook business and ads accounts, likely for subsequent sale.

Ad account theft, the systematic hijacking of Meta Business Manager and Google Ads accounts, has grown into a commodity-driven cybercrime economy... Legitimate ad spend history raises account trust scores, meaning aged, active accounts can serve ads that pass platform safety checks that would reject a new attacker-created account.

Attackers who gain access often add their own admins and downgrade the legitimate owner to a limited role, something platform permission structures don’t always let a newly added admin reverse.

The PowerShell command inside the LNK is lightly obfuscated using simple tricks like adding quotes, concatenation, and string replace which are used to bypass static detections.

LNK files are artificially inflated to the size of ~300mb

Double-clicking the executable (camouflaged as another type of file) inside it... Includes a fake Office or PDF document icon... .lnk files with PowerShell payloads, plus .scr executables, both obscured by double extensions (.pdf.lnk, .docx.scr)

Finally, the 2nd-stage PowerShell deletes the initial LNK file to cover its tracks

Ad account theft, the systematic hijacking of Meta Business Manager and Google Ads accounts, has grown into a commodity-driven cybercrime economy... Legitimate ad spend history raises account trust scores, meaning aged, active accounts can serve ads that pass platform safety checks that would reject a new attacker-created account.

.NET core “single file” apps are multiple binaries appended to one another... the first binary in the append chain has the responsibility of being a “.NET loader” that loads subsequent .NET resources (appended after the loader) into memory at runtime. Once the resources get loaded, the actual .NET app gets run.

T1622 Debugger Evasion Malware checks if debugger is present.

In particular, the extension snatches cookies and details of accounts that the victim is signed in to on the device.

“For each of the browsers that it finds, it extracts all the stored cookies...”

T1012 Query Registry Malware tries to identify default browser.

Malware tries to ping IP address in HEX format to check internet connectivity.

T1057 Process Discovery If there are less than 150 running processes the malware won’t execute.

T1083 File and Directory Discovery Malware tries to steal browser cookies from specific locations.

T1622 Debugger Evasion Malware checks if debugger is present.

The threat actors will ask the interested applicant to review the job application package by: Downloading an archive

It constantly sends the details of all open browser tabs to the command-and-control (C&C) server, and if detecting Facebook-related URLs, checks for ads and business accounts to try and steal them.

Makes use of Telegram for C2 communications

“...shifted entirely to using Telegram as their C&C channel making use of the Telegram Bot functionality... used the webhook option for one of the bots...”

MITRE ATT&CK Matrix ... T1132.001 Data Encoding: Standard Encoding

Stolen credentials and cookies are forwarded to a C&C server registered in Vietnam.

the malware exfiltrated data via a Telegram bot, in this case via an HTTP request to: hxxps://api.telegram.org/.../sendMessage