DarkCrystal RAT Campaign: A New Threat Evolving from SVG Attachments
In a recent analysis by the Trellix Advanced Research Center (ARC), a disturbing trend has emerged with the DarkCrystal RAT (DCRat) campaign. This operation highlights how cybercriminals are exploiting an ostensibly harmless attachment—specifically an SVG (Scalable Vector Graphics) file—to orchestrate a sophisticated malware-delivery mechanism that poses significant risks to unsuspecting users.
The investigation was prompted by a customer escalation, drawing attention to a unique phishing tactic employed by the threat actors. The cybercriminals have adopted a Colombian judicial-themed lure, which appears to be an official communication about a legal matter. Victims are led to believe they have received an important document, thus creating a sense of urgency and exploiting their fear of potential legal repercussions.
A noteworthy aspect of this operation is the use of the SVG file format, which is ordinarily associated with vector graphics but, due to its XML foundation, can also embed JavaScript. This capability enables attackers to evade detection systems that typically apply stricter scrutiny to executable files, scripts, or macro-enabled attachments. By transforming the SVG into a delivery mechanism, the attackers significantly reduce the likelihood of the malicious content being flagged by security measures.
Once the victim opens the attachment, they are presented with a web page that supplies a password—"1601"—intended to lend an air of authenticity to the document. This password not only appears legitimate but also encourages the user to extract and execute the contents hidden within the archive.
One of the technical highlights identified by Trellix is the embedded JavaScript within the SVG file. Through a process involving double Base64-encoding, the script effectively stores the malware payload, decodes it directly within the victim’s web browser, and then uses the Blob API to reconstruct the password-protected archive in the computer’s memory. Consequently, the browser saves this file as DOC-16-ENE-2026 RESOLUCION DENUNCIA JURIDICA.7z within the ‘Downloads’ directory.
This method of delivery, reminiscent of HTML-smuggling techniques, allows for the malware to bypass conventional security measures, as the archive does not need to be fetched directly from an external and potentially monitored URL. This obfuscation tactic diminishes opportunities for gateway inspection and reputation-based blocking, leaving users vulnerable.
Inside the extracted archive, victims discover a decoy executable alongside DLL dependencies that masquerade as components of the Brotli compression algorithm—libbrotlidec.dll and libbrotlienc.dll. Brotli is a legitimate, widely-used compression algorithm, lending a layer of credibility to these filenames. However, the structure of the executable’s imports uncovers a nefarious design intended for DLL sideloading.
When the decoy executable is launched, Windows resolves the dependent DLLs from the application directory, thereby allowing the attacker to load their own libraries instead of the expected legitimate ones. Trellix researchers noted that the operation commences with a phishing email containing the attachment posed as a legal resolution document. This tactic effectively instills urgency and fear, pushing users to engage with what they believe is an urgent legal matter.
In practice, this malicious DLL chain activates a series of malicious payloads without ever writing a recognizable executable directly to disk. When the SVG file is opened, it presents the victim with a fraudulent portal designed to resemble the Colombian judicial service. Any click on this page initiates a redirection, making it seem as though a document is being downloaded—another step in the illusion created by the attackers.
Moreover, the malware establishes persistence by copying itself, its dependent DLLs, and a batch file into a user-controlled directory. To ensure its re-execution upon logon, it also creates a Run registry entry, effectively embedding itself within the victim’s profile—a strategy commonly employed by remote-access trojans.
The final stages of this operation involve intricate decryption processes performed on the malware payload. By utilizing XOR and shift operations, the loader decrypts the necessary data and reconstructs the payload in memory. The disguise is further solidified when it executes under the name of a legitimate Windows component, thus blending in with benign activity.
At the time of the analysis, the command-and-control (C2) infrastructure linked to the DCRat campaign was offline, leaving the infected systems in a retry loop for commands. Nonetheless, the potential severity of this incident remains significant, as a revival of the C2 capabilities would restore the attackers’ control over compromised hosts.
In light of these developments, it is imperative for security teams to begin treating SVG attachments with heightened scrutiny, recognizing them as active threats rather than passive image files. Organizations should implement robust monitoring for activities related to browser-driven archive creation, unauthorized DLL loads from user-controllable directories, and suspicious changes to Run keys. Furthermore, vigilance toward any unexpected executions, particularly in processes like AddInProcess32.exe, can help preemptively expose this malware chain before the DarkCrystal RAT solidifies control over the victim’s system.
The ongoing research into judicial-themed SVG lures, specifically targeting Colombian users, underscores the adaptability of this cybercriminal tactic and signals that the initial access patterns that were valuable to RAT operators are likely to be reused in future attacks. As the landscape of cybersecurity evolves, continuous education and awareness will be vital components in defending against such complex and insidious threats.