Acronis TRU Alliance {VirusTotal}: Tracking FileFix, Shadow Vector, and SideWinder

Acronis Threat Research Unit (TRU), in collaboration with VirusTotal, presents practical threat-hunting case studies for three active campaigns: FileFix (a ClickFix web-based clipboard-driven PowerShell delivery), SideWinder (document-based attacks leveraging CVE-2017-0199 and CVE-2017-11882 targeting South Asia), and Shadow Vector (judicial-themed SVG lures targeting Colombia). The report explains how VirusTotal features (Livehunt, Retrohunt, VT Diff, content search, metadata filters) were used to create and refine YARA rules, recover IOCs and payload artifacts, and map infrastructure and delivery chains, and it supplies example YARA rules, hashes, and hunting guidance to reproduce and extend the detections.