Threats Tagged 'lnk'

The Larva-24009 threat actor, also known as HeptaX, has been conducting phishing email campaigns since 2023 targeting enterprises globally. The attacker uses LNK files disguised as documents to deliver malware that executes obfuscated PowerShell commands, deploying backdoors and downloading additional scripts. Persistence is established via Windows Task Scheduler, and remote access is enabled through QuasarRAT and UltraVNC. The actor steals information using NirSoft tools, custom keyloggers, and screenshot utilities, creates backdoor RDP accounts, and exfiltrates credentials, browser data, and user files. Their Notifier malware version 2.1 uses the Telegram API for status reporting. The campaigns demonstrate consistent tactics and infrastructure over multiple years.