LNK malware

The Larva-24009 threat actor (aka HeptaX) continues phishing campaigns into 2026, using LNK files disguised as documents to deliver an obfuscated PowerShell backdoor. The attack chain involves downloading additional PowerShell scripts from C2 servers, establishing persistence via scheduled tasks, installing QuasarRAT and UltraVNC for remote control, and deploying NirSoft credential theft tools and a custom keylogger. A notable evolution is the use of the Telegram API for infection status reporting in the Notifier malware v2.1.

The Kimsuky threat group is conducting spear phishing attacks impersonating diplomatic personnel, using LNK malware to deliver PebbleDash backdoor, PrxClient proxy, RDP Wrapper, UACMe, and keylogger payloads. Two attack chains are documented: one using PowerShell droppers via LNK, and another using Mshta to execute embedded HTA scripts. The attackers establish persistent RDP access by creating backdoor accounts and patching termsrv.dll for multi-session support, while PrxClient proxies C2 traffic to local port 3389 for stealthy remote control.

A multi-stage attack campaign uses malicious LNK files delivered via booking-themed phishing emails to deploy a Node.js-based backdoor. The LNK files use bigint arithmetic obfuscation to reconstruct C2 URLs, download a PowerShell payload that deploys a legitimate node.exe binary, and execute an AES-128-CBC encrypted JavaScript backdoor. The backdoor retrieves its C2 address from the TON blockchain using the EtherHiding technique, employs a custom bytecode VM interpreter for defense evasion, and supports downloading and executing additional payloads including PE files, PowerShell, and JavaScript.