CoralRaider targets victims’ data and social media accounts

• Cisco Talos discovered a new threat actor we’re calling “CoralRaider” that we believe is of Vietnamese origin and financially motivated. CoralRaider has been operating since at least 2023, targeting victims in several Asian and Southeast Asian countries. 
• This group focuses on stealing victims’ credentials, financial data, and social media accounts, including business and advertisement accounts.
• They use RotBot, a customized variant of QuasarRAT, and XClient stealer as payloads in the campaign we analyzed.
• The actor uses the dead drop technique, …

accounts actor business calling cisco cisco talos countries credentials data financial financial data media origin social social media stealing talos targeting threat threat actor we believe