无论何时何地……盲鹰袭击：暗影矢量案.pdf

1、1 Acronis 2026Whenever,Wherever Blind Eagle Attacks:The Shadow Vector CaseSantiago PontiroliThreat Intelligence Research Lead3 Acronis 2026The Unusual AttachmentThis campaign used scalable vector graphics(SVG),which render like imagesBut they can contain links and scriptsThat one format choice bypas

2、sed traditional defenses4 Acronis 2026A Tiny Starting PointNo advanced malware familyNo obvious threat actorNo prior indicatorsJust a suspicious attachmentToo little data to draw conclusions.5 Acronis 2026Defenders shift left.Attackers shift right.SVG is an XML based format,not a static imageWhen th

3、e user opens the file,the link executes in the browserNo exploit required,just normal user behaviorWe try to stop attacks earlier in the chain and SVG smuggling flips that model6 Acronis 20267 Acronis 2026Social Engineering FirstLocal language and institutionsThe emails impersonated Colombian courts

4、Legal notices and urgent summonsThe attackers understood their audience8 Acronis 2026“The Judicial Branch is being used by cybercriminals to steal valuable information from citizens through emails.At the Superior Council of the Judiciary,we are committed to the cybersecurity of the public.”9 Acronis

5、 2026Tactics That Keep Shifting10 Acronis 2026Under the HoodScripts,loaders,and fileless executionSimple scripts pulled additional stagesDriver-based privilege escalation using vulnerable kernel-mode driversA classic layered delivery chain for remote control and credential theft11 Acronis 202612 Acr

6、onis 202613 Acronis 2026A Familiar FingerprintLegitimate applications abused to load codeAttempts to elevate privilegesProcess hollowing and persistenceNot flashy,but effectivehttps:/ Acronis 2026Staging hosted on common platformsBitbucket,Dropbox,Discord CDNFiles blended with no