Экзотические файлы: неожиданные источники киберугроз

Kaspersky researchers have identified significant blind spots in endpoint protection where exotic file formats, such as disk images (.iso, .img, .vhd), Microsoft Office extensions (.one, .xll), and scalable vector graphics (.svg), are either ignored or insufficiently scanned. These formats allow threat actors to deploy malware effectively because they are often perceived as benign by users and fail to trigger standard email or EDR filters, unlike traditional executables or macro-based documents.

In one notable campaign involving the IcedID infostealer, attackers utilized a nested delivery chain consisting of a ZIP archive containing an ISO image, which in turn held a CHM file executed via mshta to download the final payload. Additionally, specific vulnerabilities such as CVE-2025-24993 can be exploited through VHD images on unpatched Windows systems to achieve immediate code execution upon mounting. To counter these threats, organizations should implement recursive unpacking for all attachments, treat SVGs as active content rather than static images, and ensure their security tools perform deep structural analysis of complex file types.