- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Vietnam(high confidence)
- Motivation
- Financial gain
- Seen
- 2023
- Sources
- 6 sources carry it
- Identifier
- GINC-APT-0281 · coralraider
VietnamWhat it is
CoralRaider is a financially motivated threat actor of Vietnamese origin, targeting victims in Asian and Southeast Asian countries since at least 2023. They use the RotBot loader family and XClient stealer to steal victim information, with hardcoded Vietnamese words in their payloads. CoralRaider operates from Hanoi, Vietnam, and uses a Telegram bot as a C2 channel for their malicious campaigns. Their activities include system reconnaissance, data exfiltration, and targeting victims in multiple countries in the region.
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTVietnam
- MISP Galaxy (CFR tagging)Vietnam
- ThreatActor.info (Malpedia et al.)Vietnam
Targets
- Countries
- Bangladesh, China, Ecuador, Egypt, Germany, India, Indonesia, Japan, Nigeria, Norway, Pakistan, Philippines, Poland, South Korea, Syria, Türkiye, United Kingdom, United States, Vietnam
Tools
The tools and malware families the sources tie to it.
- AsyncRAT
- CORALDECK
- Client Maximus
- ClientMesh
- Living off the Land
- LummaC2
- NetSupport Manager
- Rhadamanthys
- RotBot
- XClient
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de