Threats Tagged 'colombia'

A malware campaign in Latin America uses oversized SVG files containing the full malicious payload to deliver AsyncRAT, a remote access trojan. The attack employs social engineering via emails impersonating trusted institutions with urgent legal warnings, primarily targeting Colombia. Clicking the SVG file opens a fake judicial portal to deceive victims. The campaign uses DLL sideloading to evade detection and AI-generated templates for customization. This method avoids external connections by embedding the payload directly in the SVG file. Attacks peaked mid-week in August, focusing on judicial system impersonation. No CVSS score is available, but the threat is medium severity due to its stealth and control capabilities. European organizations should be aware of this evolving tactic as it could be adapted to target other regions. Vigilance against suspicious SVG attachments and advanced detection techniques are critical for defense.

MediumMalwareSpainItalyGermany+2#ai-generated templates#colombia#asyncrat

A sophisticated phishing campaign targets Colombian users by impersonating the Attorney General's Office with judicial notification lures. The attack uses a multi-stage infection chain starting with a malicious . SVG file attachment that triggers HTA, VBS, and PowerShell scripts, ultimately injecting the AsyncRAT malware into MSBuild.exe. AsyncRAT establishes command and control (C2) communications, steals data, and can dynamically load plugins. The campaign employs anti-virtual machine (VM) techniques, persistence mechanisms, and heavy obfuscation to evade detection. Although primarily focused on Colombia, the advanced tactics and malware capabilities pose risks to any organization exposed to similar phishing vectors. The threat demonstrates extensive use of MITRE ATT&CK techniques, including execution, persistence, defense evasion, credential access, and command and control. No known exploits or CVEs are associated, and the severity is assessed as medium based on current information.

MediumMalwareSpainGermanyFrance+3#asyncrat#phishing#judicial notification

A new email attack distributing DCRAT, a Remote Access Trojan, has been uncovered. The threat actor impersonates a Colombian government entity to target organizations in Colombia. The attack employs multiple evasion techniques, including password-protected archives, obfuscation, steganography, base64 encoding, and multiple file drops. DCRAT features a modular architecture, comprehensive surveillance capabilities, information theft functions, system manipulation tools, file and process management, and browser credential harvesting. The attack chain involves a phishing email with a ZIP attachment containing a bat file, which drops an obfuscated vbs file. This file eventually runs a base64-encoded script that downloads and executes the final payload. The RAT employs various persistence mechanisms and anti-analysis techniques. It attempts to bypass Windows Antimalware Scan Interface (AMSI) and continuously tries to connect to its command-and-control server.

MediumMalwareSpainGermanyFrance+4#remote access trojan#obfuscation#credential harvesting

Hive0131 is conducting email campaigns targeting users in Colombia with fake electronic notifications of criminal proceedings, purportedly from The Judiciary of Colombia. The campaigns deliver DCRat, a banking trojan operated as Malware-as-a-Service, through embedded links or PDF lures. DCRat's presence has increased in Latin America since 2024. The infection chain involves downloading a loader called VMDetectLoader, which uses process hollowing to inject DCRat into memory. VMDetectLoader can detect virtual machines and create persistence through scheduled tasks or registry keys. DCRat has various capabilities including recording victims, file manipulation, and keystroke logging. IBM X-Force assesses that Latin America will continue facing targeting from actors deploying banking trojans via phishing campaigns.

MediumCampaignSpainPortugalItaly+4#banking trojan#process hollowing#maas