Larva-24009 (HeptaX) operates phishing campaigns leveraging LNK files attached to emails with themes like hospital surveys and resumes to target enterprises. Execution of these files triggers obfuscated PowerShell commands that deploy backdoors and download further malicious scripts from command-and-control servers. The threat actor maintains persistence through Windows Task Scheduler and enables remote access using QuasarRAT and UltraVNC. Information theft is conducted using NirSoft utilities, custom keyloggers, and screenshot tools. Additionally, the actor creates backdoor RDP accounts and exfiltrates sensitive data including credentials and browser information. Notifier malware version 2.1 communicates status updates via the Telegram API. These campaigns have been active since 2023 and continue through 2026, showing consistent use of tactics and infrastructure.

Successful exploitation results in remote access to victim systems, persistent backdoors, credential theft, browser data exfiltration, user file theft, and monitoring via keyloggers and screenshots. The attacker can maintain long-term access and control over compromised systems, potentially leading to significant data compromise and operational disruption.

No official patch or fix is applicable as this is a threat actor campaign rather than a software vulnerability. Defenders should focus on user awareness to identify and avoid phishing emails with LNK attachments. Restrict execution of LNK files from email or untrusted sources. Monitor for suspicious PowerShell activity and detect use of known tools such as QuasarRAT, UltraVNC, and NirSoft utilities. Implement application whitelisting and endpoint detection and response solutions to help mitigate infection. Refer to the vendor advisory at https://asec.ahnlab.com/en/94786/ for detailed detection and response guidance.