Executive Summary
This report details recent tradecraft observed in intelligence-driven threat hunting, focusing on the evolution of threat actors like the Colombian Smugglers. This group, which historically targeted Colombian entities, has expanded its operations to US and European companies. They primarily utilize SVG smuggling for initial delivery and deploy a diverse malware arsenal including vjw0rm, Quasar, Remcos, and XWorm. The report also highlights the 'Kali365' platform, which specializes in Device Code Phishing to bypass traditional MFA by abusing Microsoft's legitimate device authorization endpoints.
Technically, the analysis covers various behavioral artifacts such as hardcoded mutex prefixes (Global\\EVOLUTION) and specific file paths used by stealers like UnixStealer. Adversaries are also observed abusing Living-off-the-Land Binaries (LOLBins), specifically MSBuild.exe, to establish C2 connections and exfiltrate host reconnaissance data. This shift towards behavioral-based hunting is essential as attackers increasingly rotate infrastructure to evade simple indicator-based blocking.