DCRat Campaign Hides Malware Archive Inside SVG Using HTML Smuggling
DCRat Campaign Hides Malware Archive Inside SVG Using HTML (TL-2026-2015) is a high-severity malware campaign, first published 2026-08-14. It has no confirmed attribution, affects Microsoft Windows, maps to 16 MITRE ATT&CK techniques (T1027, T1027.006, T1036.005), and is covered by 9 detection rules and 16 indicators of compromise.
Key facts for TL-2026-2015
- Threat ID
- TL-2026-2015
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-08-14
- Last reviewed
- 2026-08-14
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, legal, general
- Target regions
- colombia, Latin America
- Detection rules
- 9
- Indicators of compromise
- 16
Malware and tooling in DCRat Campaign Hides Malware Archive Inside SVG Using HTML
Malware and tooling: AsyncRAT, DCRat, 7-Zip, DCRAT - S9017
A phishing campaign impersonating Colombian judicial notifications delivers DCRat (DarkCrystal RAT) via SVG attachments that use double Base64-encoded HTML smuggling to reassemble a password-protected 7z archive client-side. Extraction leads to DLL sideloading via fake Brotli compression libraries and process hollowing into AddInProcess32.exe, deploying DCRat with active C2 reconnection to 158.94.208.109.
How DCRat Campaign Hides Malware Archive Inside SVG Using HTML works
Trellix analysts identified an ongoing DCRat (DarkCrystal RAT) delivery campaign that abuses SVG file smuggling to bypass email security controls. The phishing lure impersonates a Colombian judicial notice titled 'Resolución Denuncia Jurídica' and carries a filename date of 16 January 2026 ('DOC-16-ENE-2026'). The SVG attachment is treated by mail gateways as an image, but embeds double Base64-encoded JavaScript that, when the file is opened in a browser, decodes and uses Blob functions to reconstruct a password-protected 7z archive (password '1601') entirely client-side before prompting the user to save and open it -- classic HTML smuggling, now nested inside an SVG container rather than an .html/.htm file.
Inside the archive, a decoy executable ships alongside two malicious DLLs -- libbrotlidec.dll and libbrotlienc.dll -- named and placed to be picked up by Windows' default DLL search order when the legitimate-looking program calls Brotli compression functions (BrotliEncoderCreateInstance and related exports), a DLL sideloading technique also documented independently in other 2026 sideloading campaigns delivering DCRat. Once loaded, the malicious code creates AddInProcess32.exe -- a legitimate .NET add-in hosting binary -- in a suspended state, hollows its memory, and resumes it running DCRat's payload (tracked here as Client.exe), so the RAT executes and persists under the identity of a trusted Windows component even after its parent process exits.
DCRat itself is a modular, C#-based, AsyncRAT-derived remote access trojan sold as malware-as-a-service since 2018. Its plugin framework is stored compressed in the Windows registry and executed reflectively from memory rather than dropped to disk, and it maintains persistence via Registry Run key entries. Trellix's telemetry captured active, repeated C2 reconnection attempts from the infected host to 158.94.208.109 over an encrypted channel, consistent with DCRat's documented behavior of beaconing over TLS with certificate pinning. Core DCRat capabilities relevant to this deployment include keystroke logging, theft of stored browser/FTP credentials, screen capture, file exfiltration, and remote command execution -- giving the operator full interactive control plus a credential-harvesting and surveillance capability once the hollowed process is running.
This delivery chain sits within a broader, ongoing pattern of SVG-based, court/legal-themed phishing lures targeting Colombian users and organizations to deliver DCRat and related loaders (independently documented by other vendors under names such as 'Shadow Vector' and in BlindEagle activity using a different SVG-to-PowerShell-to-Caminho-to-DCRat chain) -- this specific incident is technically distinct (SVG-smuggled 7z archive + Brotli DLL sideloading + AddInProcess32 hollowing rather than a PowerShell/Caminho downloader chain) but shares the same regional lure theme and end payload family, so detections should account for both delivery variants.
MITRE ATT&CK techniques used in TL-2026-2015
Defense Evasion
T1027 Obfuscated Files or Information; T1027.006 HTML Smuggling; T1036.005 Match Legitimate Resource Name or Location; T1055.012 Process Hollowing; T1140 Deobfuscate/Decode Files or Information; T1574.001 DLL
Collection
T1056.001 Keylogging; T1113 Screen Capture
Execution
T1059.007 JavaScript; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1573 Encrypted Channel
defense-impairment
Persistence
T1547.001 Registry Run Keys / Startup Folder
Credential Access
T1555.003 Credentials from Web Browsers
Initial Access
Affected products and versions in DCRat Campaign Hides Malware Archive Inside SVG Using HTML
- Microsoft — Windows
Vulnerable versions: Windows systems relying on default DLL search-order behavior (technique-driven, not version-specific)
Remediation for DCRat Campaign Hides Malware Archive Inside SVG Using HTML
Immediate actions
- Block outbound network traffic to the observed C2 IP 158.94.208.109 at the perimeter/firewall and proxy layer
- Hunt for and quarantine email, SVG, archive, DLL, and executable artifacts matching the campaign's known hashes
- Flag or quarantine inbound emails carrying SVG attachments impersonating Colombian judicial/legal notifications (e.g., 'Resolución Denuncia Jurídica')
Workarounds
- Configure secure email gateways to statically parse SVG attachments for embedded <script> elements and Base64 blobs rather than allow-listing SVG as a safe image type
- Train users not to enter archive passwords supplied by the same email/webpage that delivered the archive, and not to open unsolicited legal/judicial-themed attachments
Longer-term hardening
- Deploy email/attachment sandboxing that detonates and inspects SVG files for embedded <script>/JavaScript rather than treating SVG purely as an image MIME type
- Enforce DLL search-order hardening (safe DLL search mode, fully-qualified LoadLibrary paths, signed-DLL enforcement) to prevent sideloading of attacker-supplied libbrotlidec.dll/libbrotlienc.dll alongside trusted binaries
- Monitor for anomalous process creation of AddInProcess32.exe outside legitimate .NET add-in hosting contexts, and for suspend/hollow/resume API sequences (NtAllocateVirtualMemory, NtWriteVirtualMemory, SetThreadContext, NtResumeThread) targeting it
- Detect and block DCRat's registry-resident plugin storage and Registry Run key persistence via EDR registry-write telemetry
Weaknesses (CWE) in DCRat Campaign Hides Malware Archive Inside SVG Using HTML
CWE-427
Timeline of DCRat Campaign Hides Malware Archive Inside SVG Using HTML
- Trellix analysts began investigating the campaign following a customer escalation; Trellix's published analysis dates this only as 'early 2026' without a specific day, so this event is anchored to the start of that reported window.
- The phishing lure's decoy filename 'DOC-16-ENE-2026 RESOLUCION DENUNCIA JURIDICA.7z' bears a document date of 16 January 2026 (Spanish 'ENE' = January), the date referenced in the fraudulent Colombian judicial notice used to social-engineer victims.
- Trellix's DCRat SVG-smuggling campaign analysis is publicly reported via Cyber Security News.
- Public reporting confirms active, repeated C2 reconnection attempts from infected hosts to 158.94.208.109 observed during Trellix's analysis.
- Public reporting documents process hollowing of the legitimate AddInProcess32.exe binary to run the DCRat payload (Client.exe) under a trusted process identity.
- Public reporting documents DLL sideloading via malicious libraries masquerading as Brotli compression DLLs (libbrotlidec.dll, libbrotlienc.dll) placed alongside the extracted decoy executable.
- Public reporting details the SVG HTML-smuggling delivery mechanism: double Base64-encoded JavaScript embedded in the SVG uses Blob functions to reconstruct a password-protected 7z archive client-side.
Sources cited for DCRat Campaign Hides Malware Archive Inside SVG Using HTML
- DCRat Campaign Hides Malware Archive Inside SVG Using HTML Smuggling
- DCRat Targets Users with HTML Smuggling
- Hiding in Plain Sight: Multi-Actor ahost.exe Attacks (AddInProcess32 process hollowing / DCRat sideloading corroboration)
- BlindEagle APT: DCRAT & Caminho Malware Target Colombia
- Shadow Vector targets Colombian users via privilege escalation and court-themed SVG decoys
- DCRAT Impersonating the Colombian Government
- BlindEagle Hits Colombia Gov with Caminho & DCRAT
- DCRat Malware Spreads via HTML Smuggling
- Analytics Story: DarkCrystal RAT
- A deep dive into DCRAT/DarkCrystalRAT malware
- DCRat: Versatile Remote Access Trojan Explored
- Process Injection: Process Hollowing, Sub-technique T1055.012 - MITRE ATT&CK
- Hijack Execution Flow: DLL Side-Loading, Sub-technique T1574.002 - MITRE ATT&CK
Threats related to DCRat Campaign Hides Malware Archive Inside SVG Using HTML
- Operation Turb00: Multi-Stage HijackLoader (IDAT Loader) Campaign Delivers Vidar v2.1 Infostealer and SnappyClient RAT via PNG-IDAT Steganography
- PhantomStealer Infostealer Distributed via Phishing Campaign with BYOVD Security Software Killer
- ScreenConnect Masked as Freeware: Large-Scale AsyncRAT Distribution Campaign via SEO-Poisoned Fake Software Sites
- Remcos RAT: Technical Analysis of Windows Remote Access Trojan Operations
- VIP Crypt and ASMCrypt: Commercial Crypter Services Enabling Malware Evasion of Windows Defenses
- Sophos X-Ops: Attackers Impersonate Claude, ChatGPT, Copilot and Perplexity to Distribute Infostealers, Backdoors and Malicious Browser Extensions
Detection coverage for TL-2026-2015
As of 2026-08-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2015 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.