# DCRat Campaign Hides Malware Archive Inside SVG Using HTML Smuggling

> A phishing campaign impersonating Colombian judicial notifications delivers DCRat (DarkCrystal RAT) via SVG attachments that use double Base64-encoded HTML smuggling to reassemble a password-protected 7z archive client-side. Extraction leads to DLL sideloading via fake Brotli compression libraries and process hollowing into AddInProcess32.exe, deploying DCRat with active C2 reconnection to 158.94.208.109.

- **Published:** 2026-08-14T00:00:00Z
- **Last reviewed:** 2026-08-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2015
- **ID:** TL-2026-2015
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Trellix analysts identified an ongoing DCRat (DarkCrystal RAT) delivery campaign that abuses SVG file smuggling to bypass email security controls. The phishing lure impersonates a Colombian judicial notice titled 'Resolución Denuncia Jurídica' and carries a filename date of 16 January 2026 ('DOC-16-ENE-2026'). The SVG attachment is treated by mail gateways as an image, but embeds double Base64-encoded JavaScript that, when the file is opened in a browser, decodes and uses Blob functions to reconstruct a password-protected 7z archive (password '1601') entirely client-side before prompting the user to save and open it -- classic HTML smuggling, now nested inside an SVG container rather than an .html/.htm file.

Inside the archive, a decoy executable ships alongside two malicious DLLs -- libbrotlidec.dll and libbrotlienc.dll -- named and placed to be picked up by Windows' default DLL search order when the legitimate-looking program calls Brotli compression functions (BrotliEncoderCreateInstance and related exports), a DLL sideloading technique also documented independently in other 2026 sideloading campaigns delivering DCRat. Once loaded, the malicious code creates AddInProcess32.exe -- a legitimate .NET add-in hosting binary -- in a suspended state, hollows its memory, and resumes it running DCRat's payload (tracked here as Client.exe), so the RAT executes and persists under the identity of a trusted Windows component even after its parent process exits.

DCRat itself is a modular, C#-based, AsyncRAT-derived remote access trojan sold as malware-as-a-service since 2018. Its plugin framework is stored compressed in the Windows registry and executed reflectively from memory rather than dropped to disk, and it maintains persistence via Registry Run key entries. Trellix's telemetry captured active, repeated C2 reconnection attempts from the infected host to 158.94.208.109 over an encrypted channel, consistent with DCRat's documented behavior of beaconing over TLS with certificate pinning. Core DCRat capabilities relevant to this deployment include keystroke logging, theft of stored browser/FTP credentials, screen capture, file exfiltration, and remote command execution -- giving the operator full interactive control plus a credential-harvesting and surveillance capability once the hollowed process is running.

This delivery chain sits within a broader, ongoing pattern of SVG-based, court/legal-themed phishing lures targeting Colombian users and organizations to deliver DCRat and related loaders (independently documented by other vendors under names such as 'Shadow Vector' and in BlindEagle activity using a different SVG-to-PowerShell-to-Caminho-to-DCRat chain) -- this specific incident is technically distinct (SVG-smuggled 7z archive + Brotli DLL sideloading + AddInProcess32 hollowing rather than a PowerShell/Caminho downloader chain) but shares the same regional lure theme and end payload family, so detections should account for both delivery variants.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1059.007 JavaScript
- T1027 Obfuscated Files or Information
- T1027.006 HTML Smuggling
- T1140 Deobfuscate/Decode Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1574.001 DLL
- T1055.012 Process Hollowing
- T1112 Modify Registry
- T1547.001 Registry Run Keys / Startup Folder
- T1071.001 Web Protocols
- T1573 Encrypted Channel
- T1113 Screen Capture
- T1056.001 Keylogging
- T1555.003 Credentials from Web Browsers

## Sources

- [DCRat Campaign Hides Malware Archive Inside SVG Using HTML Smuggling](https://cybersecuritynews.com/dcrat-campaign/)
- [DCRat Targets Users with HTML Smuggling](https://www.netskope.com/blog/dcrat-targets-users-with-html-smuggling)
- [Hiding in Plain Sight: Multi-Actor ahost.exe Attacks (AddInProcess32 process hollowing / DCRat sideloading corroboration)](https://www.trellix.com/blogs/research/hiding-in-plain-sight-multi-actor-ahost-exe-attacks/)
- [BlindEagle APT: DCRAT & Caminho Malware Target Colombia](https://www.zscaler.com/blogs/security-research/blindeagle-targets-colombian-government-agency-caminho-and-dcrat)
- [Shadow Vector targets Colombian users via privilege escalation and court-themed SVG decoys](https://www.acronis.com/en/tru/posts/shadow-vector-targets-colombian-users-via-privilege-escalation-and-court-themed-svg-decoys/)
- [DCRAT Impersonating the Colombian Government](https://www.fortinet.com/blog/threat-research/dcrat-impersonating-the-columbian-government)
- [BlindEagle Hits Colombia Gov with Caminho & DCRAT](https://socprime.com/active-threats/blindeagle-targets-colombian-government-agency/)
- [DCRat Malware Spreads via HTML Smuggling](https://www.msspalert.com/brief/dcrat-malware-spreads-via-html-smuggling)
- [Analytics Story: DarkCrystal RAT](https://research.splunk.com/stories/darkcrystal_rat/)
- [A deep dive into DCRAT/DarkCrystalRAT malware](https://muha2xmad.github.io/malware-analysis/dcrat/)
- [DCRat: Versatile Remote Access Trojan Explored](https://hunt.io/malware-families/dcrat)
- [Process Injection: Process Hollowing, Sub-technique T1055.012 - MITRE ATT&CK](https://attack.mitre.org/techniques/T1055/012/)
- [Hijack Execution Flow: DLL Side-Loading, Sub-technique T1574.002 - MITRE ATT&CK](https://attack.mitre.org/techniques/T1574/002/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2015