Ducktail Group Brings New Arsenal and Evasion Tactics to Uplift Its Attack Game

The recent changes

• Since early September, the attackers were using a new malware variant compiled using the .NET 7 NativeAOT feature but based on the same code base as before.
• In October, the attackers switched back to self-contained .NET Core 3 Windows binaries that contain anti-analysis code copied from GitHub to avoid detection. It features a more robust method to obtain attacker-controlled email addresses from its C2 server.
• Developers have made the malware look more legitimate by launching dummy files to hide its malicious intent, such as a document, spreadsheet, or video. Moreover, the operators have relatively increased the size of the operational team.

Additional enhancements

• The attackers have been signing the malware with EV (extended validation) certificates to evade detection and changing these certificates in the middle of the campaign after they were revoked.
• The group has set up fake businesses in Vietnam for resource development and operational expansion. For code signing certificates seven such firms have been identified, to date.
• The group is using Telegram for C2 purposes, however, it has associated multiple administrator accounts to Telegram channels to onboard affiliates into the operation.

Attack tactics

• Researchers noted some incidents where victims were targeted with archive files using WhatsApp. The initial vector for the campaigns cannot be determined due to insufficient evidence.
• However, when the attackers fail to add their email address to the intended Facebook business account due to the lack of sufficient permissions, they gathered enough information to impersonate the victim and achieve their objective via hands-on activity.

Conclusion