Malware News In early 2026 the Trellix ARC team identified and analysed an active DarkCrystal RAT (DCRat) campaign. They unpacked each stage of the infection chain

[Khushal]

Content source

https://www.trellix.com/blogs/research/signed-sealed-injected-dcrat-mechanics-2026/

Introduction​

In early 2026, the Trellix Advanced Research Center (ARC) identified and analyzed an active DarkCrystal RAT (DCRat) campaign following a critical customer escalation. The operation relied on a judicial‑themed phishing lure, masquerading as an official “Resolución Denuncia Jurídica” (legal complaint resolution) to pressure victims into opening the attachment. Every stage of the attack required human interaction, from opening the phishing email to extracting the archive to executing the malicious components alongside trusted libraries by using DLL sideloading. In its final stage, the malware employed process hollowing to inject malicious code into a trusted system process, effectively evading detection. The end payload was DCRat, granting attackers full remote access and control. This campaign is particularly notable for legitimate, signed utility to bypass traditional security perimeters.

This blog unpacks each stage of the infection chain, revealing how attackers combine stealth, sideloading, and process injection to establish long‑term access.

https://www.trellix.com/blogs/research/signed-sealed-injected-dcrat-mechanics-2026/

Here is a refined, explanatory breakdown of the infection chain identified by Trellix ARC.

Attack kill chain​

 

[Bot]

Assessment and defensive takeaways

This is a significant infection chain because it combines several well-known techniques rather than relying on a single exploit:

• Social engineering through a legal-themed lure
• User-assisted archive extraction and execution
• DLL sideloading using a legitimate, signed executable
• Process hollowing to place the payload inside a trusted process
• DCRat deployment for remote access, credential theft, and further command execution

A valid digital signature on the utility does not prove that the complete execution chain is safe. In sideloading attacks, the signed executable may be legitimate while loading an attacker-controlled DLL from the same directory. Organizations should therefore evaluate the loaded modules, parent-child process relationships, command lines, and file locations rather than trusting the signer alone.

Recommended detection and prevention measures

• Block or quarantine executable content delivered through unsolicited legal, billing, or judicial-themed emails.
• Treat archives containing EXE, DLL, SCR, BAT, CMD, or script files as high risk, especially when received from external senders.
• Monitor signed applications loading unsigned or newly created DLLs from user-writable directories such as Downloads, temporary folders, and archive extraction paths.
• Alert on unusual process hollowing or remote-thread activity involving commonly trusted Windows processes.
• Use application control or allowlisting where practical, with rules based on file path, publisher, and expected behavior rather than the signature alone.
• Ensure endpoint protection, email security, and operating-system updates are current.
• Review outbound connections and authentication activity from affected systems for possible DCRat command-and-control traffic or credential misuse.

If compromise is suspected, disconnect the system from the network without deleting evidence, preserve the email and extracted files, collect relevant endpoint and event logs, and run scans with reputable security software. Samples can also be submitted to VirusTotal, while remembering that uploads may disclose sensitive files and that a clean result does not prove safety.

The main lesson is that trusted signing is only one reputation signal. Behavioral monitoring of DLL loading, archive execution, process injection, and unusual network activity is needed to identify this type of chain.