Akodon

Akodon is a threat actor associated with the Shadow Vector malware campaign targeting users in Colombia. The activity is characterized by spear-phishing emails impersonating trusted Colombian institutions and legal entities, often using urgent judicial-themed lures to induce victims to open malicious attachments or retrieve staged payloads from public hosting services. The campaign has delivered commodity remote access malware including AsyncRAT and RemcosRAT through multistage infection chains designed for stealth, persistence, and credential-focused surveillance. Observed tradecraft includes malicious SVG-based delivery, staged script downloaders, DLL side-loading, process hollowing and injection, anti-analysis checks, and persistence through scheduled tasks and autorun mechanisms. In RemcosRAT-related chains, the actor has also used vulnerable kernel drivers for privilege escalation and included logic to enumerate and terminate security tooling. Newer iterations have used modular, memory-resident .NET loaders, in-memory execution via PowerShell reflection, and UAC bypass through trusted Windows utilities. The operation has shown strong emphasis on credential theft, banking-related theft, keylogging, and full remote access, with tooling and code characteristics suggesting overlap or code reuse with Portuguese-speaking financially motivated malware ecosystems. High-confidence attribution to a specific nation state is not supported.