SVG Files Abused in Emerging Campaigns

MITRE Techniques

• [T1193] Spearphishing Attachment – Phishing emails were used to deliver initial SVG files as attachments or via embedded links. [’emails each had an attached SVG file which, when opened, would deliver an embedded .zip archive.’]
• [T1566.002] Phishing: Spearphishing Link – Some campaigns used emails with embedded links to download malicious SVG files. [’embedded link that downloaded an SVG file which dropped an embedded .zip archive when it was opened.’]
• [T1204.002] User Execution: Malicious File – Victims are tricked into opening SVG files, triggering the smuggled payload execution. [‘when the SVG or HTML file is opened, the “smuggled” file is delivered.’]
• [T1027] Obfuscated Files or Information – AutoSmuggle embeds and obfuscates malicious files (e.g., base64 embedding) inside SVG/HTML to evade detection. [‘.zip archives embedded in the SVG files’ and ‘base64ToArrayBuffer’]
• [T1001.002] Data Obfuscation: Steganography – SVGs hide malicious content inside image-like structures, reducing suspicion compared to HTML/archives. [‘SVG files are often treated as image files rather than files containing commands.’]
• [T1059.007] Command and Scripting Interpreter: JavaScript – JavaScript in SVGs was used to download or reconstruct payloads. [‘JavaScript file, which would download a series of payloads’]
• [T1105] Ingress Tool Transfer – Secondary payloads were downloaded from external hosting (BlogSpot, free file hosts) as part of the chain. [‘starting with a payload hosted on BlogSpot’ and ‘download a series of payloads from free file hosting services’]
• [T1547.001] Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder – Delivered malware attempted persistence by adding itself to startup locations. [‘attempts to establish persistence by adding itself to startup locations.’]
• [T1082] System Information Discovery – Secondary scripts performed environment and system checks before executing stages. [‘the second stage VB script performs checks to gather information about the victim’s system and environment.’]
• [T1055] Process Injection – Final payloads used injection techniques via an Injector DLL to run inside legitimate processes (e.g., attrib.exe, RegSvcs.exe). [‘inject the final payload into legitimate processes like attrib.exe or RegSvcs.exe.’]
• [T1505.003] Software Packing: Runtime Packing – Malware used packing/packing-like techniques to hinder analysis and detection. [‘The malware employs packing techniques to hide its true nature and evade analysis.’]