Security researchers at Trellix have identified an active campaign in early 2026, publicly reported on 14th August. Named DCRat, the campaign involves malicious SVG attachments as the initial delivery mechanism for DarkCrystal RAT.

Through this blog, we will understand what the DCRat Campaign is about and what organizations can do to defend against the threat.

About the threat

How is the attack orchestrated?

Step 1: Initial delivery

– Phishing email impersonating a Colombian judicial notification

– Lure – “Resolución Denuncia Jurídica.”

– Attachment – Malicious SVG file

– Goal – Trick the victim into opening the file

Step 2: SVG Execution in the browser

The SVG file displays a fake legitimate citizen consultation portal while the hidden JavaScript (Base-64 encoded) runs silently in the background.

Goal – Gain trust and prepare for the next stage

Step 3: In-browser archive reconstruction

The malicious JavaScript reconstructs a password-protected 7-zip archive in the victim’s browser. The victim is asked to download an archive.

Goal – Deliver an encrypted payload

Step 4: Archive extraction & execution

Victim extracts the archive using the provided password or instructions in the phishing email. The archive contains malicious payload.

Goal – Deploy and execute a malicious payload

Step 5: Defense evasion & persistence

– DLL sideloading – loads malicious DLL via legit processes

– Registry Run Persistence – Adds an entry in Windows Registry Run key

– Decryption – Avoids disk detection by decrypting payload in memory

– Process hollowing – Executes DCRat by hollowing an existing legit Windows process.

– Goal – Camouflage presence while maintaining persistence

Step 6: DCRat Execution (DarkCrystal RAT)

DCRat runs as a legit Windows process offering remote access to the attacker.

Goal – Allow remote control and data theft

Key attack techniques used

• Malicious SVG – containing JavaScript capable of performing actions in the browser.
• Phishing – a legal notification themed lure to encourage the victim to open the malicious SVG attachment.
• HTML smuggling – JavaScript reconstructs a 7-zip archive locally through the browser instead of delivering it directly as an email attachment.
• DLL sideloading – loads malicious DLL via legit processes.
• Registry run persistence – Adds an entry in the Windows Registry Run key.
• In-memory decryption – Avoids disk detection by decrypting payload in memory.
• Process hollowing – Executes DCRat by hollowing existing legit Windows process.

Potential capabilities through DCRat deployment include:

• Remote access to compromised Windows systems
• Execution of commands on infected systems
• Collection of information from compromised hosts
• Communication with attacker-controlled command-and-control infrastructure
• Persistence through Windows Registry Run mechanisms
• Encrypted command-and-control communication
• Repeated attempts to reconnect to command-and-control infrastructure
• Anti-analysis capabilities
• Execution through process hollowing to make malicious activity appear associated with a legitimate Windows process

SharkStriker’s Recommendations

• Review email-security controls for SVG attachments and other active-content file formats.
• Hunt for the published campaign hashes across endpoint, email, and threat-intelligence platforms.
• Search endpoint telemetry for the identified DCRat payload and DLL indicators.
• Monitor for suspicious Registry Run modifications associated with newly created user-directory files.
• Investigate unusual loading of libbrotlidec.dll and libbrotlienc.dll.
• Monitor for suspicious execution of AddInProcess32.exe, particularly where its memory behavior or parent process is anomalous.
• Correlate process activity with outbound connections to the reported C2 indicator.
• Review systems where users opened suspicious SVG attachments followed by archive extraction or executable launch.
• Ensure EDR, email security, and SIEM detection content is capable of identifying SVG-based HTML smuggling and subsequent execution activity.
• Reinforce security awareness training around unexpected legal and government-themed email attachments.

SharkStriker’s Action

• Threat intelligence reviewed based on the publicly reported DCRat campaign.
• Campaign attack-chain details assessed for relevant detection opportunities.
• Published indicators identified for threat-hunting and monitoring purposes.
• Recommended detection coverage includes malicious SVG delivery, archive creation, DLL sideloading, Registry Run persistence, process hollowing, and suspicious C2 communication.
• Threat hunting is recommended for environments where the reported indicators or corresponding behavioral activity are observed.