Tracing the Path of VietCredCare and DuckTail: Vietnamese dark market of infostealers’ data
ID: c19f9f32-fad5-5dbc-b692-b10d9033edc8
STIX ID: report--c19f9f32-fad5-5dbc-b692-b10d9033edc8
Feed Name: Group-IB Blog
In mid-2024 Group-IB analyzed and compared two Vietnamese Windows infostealer families—VietCredCare and DuckTail—that harvest Facebook credentials and session cookies to monetize compromised Facebook Business accounts. The report documents differences in delivery (mass disguised executables vs. targeted LinkedIn/WhatsApp lures), code structure (.NET implementations), exfiltration (Telegram API with differing data formats and encryption), supported browsers, and monetization (selling raw account data or running fraudulent ad campaigns), notes law-enforcement activity reducing VietCredCare but continued DuckTail campaigns, and provides mitigation recommendations.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.