Shadow Vector

Shadow Vector is a malware campaign targeting users in Colombia through spear-phishing emails that impersonate trusted Colombian institutions and legal entities, frequently using urgent court-notification lures. The campaign commonly relies on malicious SVG attachments and multi-stage delivery chains that fetch additional components from public hosting services. Observed payloads include AsyncRAT and RemcosRAT, indicating an emphasis on remote access, credential theft, banking theft, and keylogging. The campaign uses layered execution and evasion techniques including DLL sideloading, process hollowing or injection, anti-analysis checks, and persistence through scheduled tasks and autorun mechanisms. In AsyncRAT-related chains, operators have used custom loader components, encrypted configuration handling, sandbox and debugger detection, and plugin-based extensibility. In Remcos-related chains, activity has included abuse of vulnerable drivers for kernel-level privilege escalation and process termination logic aimed at security tools. More recent activity has also used staged JavaScript, VBS, and PowerShell components, in-memory .NET loading, and UAC bypass behavior consistent with modular loader tradecraft. Some tooling overlaps or code-reuse indicators suggest links to Portuguese-speaking financially motivated malware ecosystems, but attribution to a specific named threat actor or state sponsor is not established. Shadow Vector is best characterized as a financially motivated intrusion campaign focused on Colombian victims, using phishing-driven initial access and commodity remote-access malware combined with increasingly sophisticated loader, evasion, and privilege-escalation techniques.