Loading story…
ESET has identified a campaign using SVG smuggling to deliver AsyncRAT, primarily targeting Colombian users with emails mimicking government portals. The attack leverages large SVG files containing all necessary payloads, evading traditional detection and using DLL sideloading for persistence. AI-generated code artifacts were observed, complicating detection and analysis.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
Japan moved forward with new legislation expanding authorities for more proactive or active cyber measures, including incident reporting requirements for critical infrastructure and the ability to intercept foreign internet traffic. The measures reflect a policy response to the country’s worsening threat landscape.
Cisco Talos reported exploitation activity in Japan involving a PHP CGI vulnerability on Windows that was used to deploy Cobalt Strike reverse proxies. The activity added to evidence of active intrusion operations affecting Japanese organizations.
Japan’s Board of Audit found that dozens of critical government systems across multiple agencies were not managed according to required security standards, and many lacked business continuity plans. The finding illustrated gaps in governance and resilience amid rising threats.
Russian state-backed APT28, attributed to GRU Unit 26165, launched a cyber espionage campaign against Ukrainian military personnel using weaponized Signal chats and malicious Office documents. The operation compromised at least 42 hosts and stole sensitive military data while introducing the BeardShell backdoor with cloud-based command-and-control techniques.
Researchers reported an AsyncRAT distribution campaign that used malicious SVG files masquerading as web portals to infect targets. The campaign showed continued abuse of deceptive file formats for malware delivery.
A notable breach at NTT Communications in 2025 was referenced as an example of the broader cyber risk facing major Japanese organizations. The article did not provide a more specific incident date.
Reports cited in the reference said Japan experienced a significant increase in cyber incidents in 2024. The rise highlighted growing pressure on government and critical infrastructure defenses.
Trend Micro cited the long-running MirrorFace campaign as likely causing critical data loss in Japan, underscoring the country’s exposure to nation-state cyber espionage. The exact date was not specified in the reference.
9 references tracked. Mallory keeps watching after this page renders.
darkreading.com
Open sourcego.theregister.com
Open sourcecyberscoop.com
Open sourceoptiv.com
Open sourceblog.knowbe4.com
Open sourcescworld.com
Open sourcedarkreading.com
Open sourcescworld.com
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A sophisticated phishing campaign has been identified targeting users in Colombia by impersonating official judicial notifications from the 17th Municipal Civil Court of the Bogotá Circuit. The attackers crafted emails in Spanish, leveraging local institutional details to increase the credibility of the lure. The phishing emails claim to contain a lawsuit notification and prompt recipients to open an attached SVG file. This SVG file is weaponized to initiate a multi-stage infection chain. Upon opening, the SVG file triggers the execution of a malicious HTA (HTML Application) file, which is a common technique for bypassing traditional email security filters. The HTA file then executes a VBS (Visual Basic Script) file, which in turn runs a PowerShell script. This PowerShell script acts as a downloader and loader, ultimately injecting the AsyncRAT remote access trojan into a legitimate Windows process to evade detection. AsyncRAT is a well-known remote access tool that allows attackers to gain persistent control over infected systems, exfiltrate data, and potentially deploy additional payloads. The campaign employs anti-virtual machine techniques to avoid analysis and uses persistence mechanisms to maintain access on compromised hosts. Security researchers have observed that the use of SVG files for initial infection is increasing, as these files can bypass some security controls due to their perceived harmlessness. The campaign demonstrates a high level of technical sophistication, chaining multiple scripting languages and file types to obfuscate the attack and evade endpoint detection. The malicious files have been identified and their MD5 hashes documented for threat intelligence sharing. Detection signatures have been updated by security vendors such as Quick Heal and Seqrite to identify and block the components of this attack. The campaign is notable for its targeted approach, focusing on Colombian users and leveraging local judicial terminology to increase the likelihood of success. The use of AsyncRAT as the final payload provides attackers with extensive capabilities for surveillance, data theft, and further lateral movement within affected organizations. Security teams are advised to educate users about the risks of opening unexpected attachments, especially those purporting to be from legal or government institutions. Organizations should also ensure that email security solutions are updated to detect SVG-based threats and that endpoint protection is capable of identifying the multi-stage infection chain. The incident highlights the evolving tactics of threat actors in using file formats and social engineering tailored to specific regions and institutions.
Jun 29, 2026
A phishing campaign is delivering **DarkCrystal RAT (DCRat)** through weaponized SVG attachments that use **HTML smuggling** to drop a password-protected `7z` archive onto Windows systems. Researchers said the lure impersonates a Colombian legal notice, **“Resolución Denuncia Jurídica,”** and presents a fake citizen consultation portal that instructs victims to open the downloaded archive with the password `1601`, making the staged delivery appear legitimate while shifting malicious assembly into the victim’s browser to evade email inspection. The attack chain uses double-Base64-encoded JavaScript embedded in the SVG, followed by DLL sideloading with files disguised as Brotli components, persistence through a Windows Registry **Run** entry, and process hollowing into `AddInProcess32.exe`. The final payload installs DCRat, a remote access trojan that supports encrypted command-and-control communications, anti-analysis checks, and repeated beaconing to `158[.]94[.]208[.]109`, giving attackers sustained access to compromised hosts.
Aug 17, 2026
Security researchers reported an **AsyncRAT** malware campaign that used phishing emails and HTML smuggling to deliver malicious ISO images while bypassing traditional network inspection. The lures arrived as HTML attachments disguised as receipts or order confirmations, with embedded JavaScript reconstructing a Base64-encoded ISO directly in the victim’s browser instead of downloading it from a remote server. Researchers said the activity was active from at least September 2021 and in some cases also used drive-by delivery, with the technique helping the attackers evade sandboxes, proxies, firewalls, and many antimalware engines for months. When victims opened the mounted ISO on Windows, it exposed a `.bat` or `.vbs` file that launched PowerShell, fetched or unpacked additional stages, established persistence, and executed .NET components in memory before deploying **AsyncRAT** and in some cases **NJRAT**. The campaign used multiple defense-evasion measures, including antivirus checks, Windows Defender exclusions, UAC bypass, disabling Action Center notifications, reflective DLL loading, and process injection into legitimate binaries such as `aspnet_compiler.exe` and `MSBuild.exe`; researchers also linked earlier variants to crypter-as-a-service tools including **HCrypt** and **Alosh** and warned of follow-on risks including credential theft and data exfiltration.
Aug 15, 2026