VERY IMPORTANT

A sophisticated phishing campaign targets Colombian users with a judicial notification lure, exploiting an .SVG file attachment to deliver AsyncRAT. The attack chain involves multiple stages, including SVG, HTA, VBS, and PowerShell scripts, ultimately injecting the malware into MSBuild.exe. The campaign uses geographical and institutional details to appear legitimate, impersonating the Attorney General's Office. It employs anti-VM techniques, persistence mechanisms, and obfuscation methods to evade detection. The AsyncRAT payload steals data, establishes C2 communication, and can dynamically load plugins. The attack demonstrates advanced tactics, techniques, and procedures across various MITRE ATT&CK categories.