A recent cyberattack campaign has been identified, leveraging SVG files to distribute the DCRat malware through a technique known as HTML smuggling. This method allows attackers to bypass traditional security measures by embedding malicious code within seemingly benign image files.
The attack initiates with phishing emails that masquerade as official legal notifications, urging recipients to open an attached SVG file. Upon opening, the SVG displays a counterfeit citizen consultation portal, enhancing the illusion of legitimacy. The page then prompts the user to download a password-protected archive, providing the password to encourage access.
Embedded within the SVG is double Base64-encoded JavaScript. This script decodes itself and utilizes the browser’s Blob function to reconstruct and download the malicious archive directly onto the victim’s system. This approach effectively evades detection by email security tools, as the harmful payload is assembled within the browser environment.
Once the archive is opened, it contains a decoy executable alongside several DLL files designed to mimic legitimate Brotli compression components. When the user executes the decoy program, the operating system loads these attacker-supplied DLLs, a technique known as DLL sideloading. This method allows the malware to operate under the guise of a legitimate application, complicating detection efforts.
Subsequently, the loader establishes persistence by creating a folder in the user’s directory, copying necessary files, and adding a Windows Registry Run entry. It then decrypts and injects the DCRat payload into a suspended ‘AddInProcess32.exe’ process, a legitimate Windows component. This process hollowing technique enables the malware to run covertly, maintaining remote control capabilities while appearing innocuous.
The DCRat malware, also known as DarkCrystal RAT, provides attackers with extensive remote access to infected systems. Its capabilities include executing commands, collecting data, and maintaining communication with command-and-control servers. The use of HTML smuggling in this campaign underscores the evolving sophistication of cyber threats, as attackers continually develop methods to circumvent security defenses.
Organizations and individuals should exercise caution when encountering unexpected email attachments, even those appearing as standard image files. Implementing robust email filtering, educating users on phishing tactics, and maintaining up-to-date security software are crucial steps in mitigating such threats.
