CoralRaider

Also known as: CoralRaider

CoralRaider is a financially motivated threat actor of Vietnamese origin, targeting victims in Asian and Southeast Asian countries since at least 2023. They use the RotBot loader family and XClient stealer to steal victim information, with hardcoded Vietnamese words in their payloads. CoralRaider operates from Hanoi, Vietnam, and uses a Telegram bot as a C2 channel for their malicious campaigns. Their activities include system reconnaissance, data exfiltration, and targeting victims in multiple countries in the region.

🌍 Country Vietnam

Associated Operations

2024-02 Suspected CoralRaider continues to expand victimology using three information stealers https://blog.talosintelligence.com/suspected-coralraider-continues-to-expand-victimology-using-three-information-stealers/

Introduction

CoralRaider is a financially motivated threat actor of Vietnamese origin, targeting victims in Asian and Southeast Asian countries since at least 2023. They use the RotBot loader family and XClient stealer to steal victim information, with hardcoded Vietnamese words in their payloads. CoralRaider operates from Hanoi, Vietnam, and uses a Telegram bot as a C2 channel for their malicious campaigns. Their activities include system reconnaissance, data exfiltration, and targeting victims in multiple countries in the region.

Activities and Tactics

Country of Origin: 🇻🇳 Vietnam

Notable Campaigns

  • 2024-02
  • Suspected CoralRaider continues to expand victimology using three information stealers
  • https://blog.talosintelligence.com/suspected-coralraider-continues-to-expand-victimology-using-three-information-stealers/

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • CORALDECK
  • ClientMesh
  • Client Maximus
  • AsyncRAT:
  • Living off the Land:
  • LummaC2:
  • NetSupport Manager:
  • Rhadamanthys:
  • RotBot:
  • XClient:

Attribution and Evidence

Country of Origin: Vietnam Additional attribution information pending cataloguing.

References

References pending cataloguing.