MALWARE FAMILY

DUCKTAIL

Internal ID: win.ducktail

aliases

Last seen:Mar 17, 2026

Intelligence Profile

According to Tony Lambert, this is a malware written in .NET. It was observed to be delivered using the .NET Single File deployment feature.

Threat Analysis

DUCKTAIL is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://forensicitguy.github.io/analyzing-net-core-single-file-ducktail/

→https://harfanglab.io/en/insidethelab/reverse-engineering-ida-pro-aot-net/

→https://labs.withsecure.com/assets/BlogFiles/Publications/WithSecure_Research_DUCKTAIL.pdf

→https://labs.withsecure.com/content/dam/labs/docs/WithSecure_Research_DUCKTAIL.pdf

→https://securelist.com/ducktail-fashion-week/111017/

→https://www.appgate.com/blog/vietnamese-information-stealer-campaigns-target-professionals-on-linkedin

→https://www.deepinstinct.com/blog/ducktail-threat-operation-re-emerges-with-new-lnk-powershell-and-other-custom-tactics-to-avoid-detection

→https://www.f-secure.com/content/dam/labs/docs/WithSecure_Research_DUCKTAIL.pdf

→https://www.trendmicro.com/en_us/research/23/e/managed-xdr-investigation-of-ducktail-in-trend-micro-vision-one.html

→https://www.zscaler.com/blogs/security-research/look-ducktail

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.ducktail

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search DUCKTAIL