HOMETHREATSDUCKTAIL
APT / THREAT GROUP

DUCKTAIL

2
aliases
Last seen:Mar 17, 2026

Intelligence Profile

According to Tony Lambert, this is a malware written in .NET. It was observed to be delivered using the .NET Single File deployment feature.

Threat Analysis

DUCKTAIL is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://forensicitguy.github.io/analyzing-net-core-single-file-ducktail/
→https://harfanglab.io/en/insidethelab/reverse-engineering-ida-pro-aot-net/
→https://labs.withsecure.com/assets/BlogFiles/Publications/WithSecure_Research_DUCKTAIL.pdf
→https://labs.withsecure.com/content/dam/labs/docs/WithSecure_Research_DUCKTAIL.pdf
→https://securelist.com/ducktail-fashion-week/111017/

Quick Facts

TypeAPT / Threat Group
Aliases2

Also Known As

DUCKTAILwin.ducktail

External Intelligence

Malpedia: win.ducktail

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search DUCKTAIL