Larva-24009 (HeptaX) operates phishing campaigns using LNK files to deliver malware that executes obfuscated PowerShell commands. These commands deploy backdoors and download further scripts from command-and-control servers. The threat actor establishes persistence via Windows Task Scheduler and enables remote access using QuasarRAT and UltraVNC. Information theft is conducted with NirSoft utilities, custom keyloggers, and screenshot tools. The actor also creates backdoor RDP accounts and exfiltrates sensitive data including credentials and browser information. Notifier malware version 2.1 reports status via Telegram API. The campaigns have targeted enterprises globally since 2023 and remain active through 2026, demonstrating consistent tactics and infrastructure.

Successful exploitation results in remote access to victim systems, persistent backdoors, credential theft, browser data exfiltration, user file theft, and monitoring via keyloggers and screenshots. The attacker can maintain long-term access and control, potentially leading to significant data compromise and operational disruption.

No official patch or fix is applicable as this is a threat actor campaign rather than a software vulnerability. Defenders should focus on user awareness to identify and avoid phishing emails with LNK attachments, restrict execution of LNK files from email or untrusted sources, monitor for suspicious PowerShell activity, and detect use of known tools such as QuasarRAT, UltraVNC, and NirSoft utilities. Implementing application whitelisting and endpoint detection can help mitigate infection. Refer to the vendor advisory at https://asec.ahnlab.com/en/94786/ for detailed detection and response guidance.