Shortcut-Based (LNK) Attacks Delivering Malicious Code On The Rise

guest · Jul 18, 2022

MLNK Builder 4.2 released in Dark Web – malicious shortcut-based attacks are on the rise
July 18, 2022

Resecurity, Inc. (USA), a Los Angeles-based cybersecurity company protecting Fortune 500 worldwide, has detected an update of one of the most popular tools used by cybercriminals to generate malicious LNK files, so frequently used for malicious payloads delivery nowadays.

MLNK Builder has emerged in Dark Web with the new version (4.2) and the updated feature-set focused on AV evasion and masquerading with icons of popular legitimate applications and file formats.
Click to expand...

The spike of notable campaigns involving malicious shortcuts (LNK files) conducted by both APT groups and advanced cybercriminals has been detected in April-May period this year – Bumblebee Loader and UAC-0010 (Armageddon) targeting EU Countries described by CERT UA. Malicious shortcuts continue to give a hard time for network defenders, especially, in combating global botnet and ransomware activity using them as a channel for multi-staged payload delivery.

According to experts from Resecurity, existing customers of MLNK Builder will receive an update for free, but the authors have also released a “Private Edition” available for a tight circle of vetted customers or additional license in $125 per build.
Click to expand...

Resecurity: Shortcut-Based (LNK) Attacks Delivering Malicious Code On The Rise

Malicious shortcuts continue to give hard times to network defenders, especially when combating global botnet and ransomware activity, using them as a channel for multi-staged payload deliveries.
Why Attackers Use LNK File
Such files typically look legitimate, and may have an icon the same as an existing application or document. The bad actors incorporate malicious code into LNK files (e.g. Powershell scenario) allowing the execution of the payload on the target machine.
Click to expand...

The most actively used malware families leveraging LNK-based distribution are TA570 Oakboat (aka Qbot), IcedID, AsyncRAT and the new strain of Emotet. The most recent Qakbot distribution campaign also included malicious Word documents using the CVE-2022-30190 (Follina) zero-day vulnerability in the Microsoft Support Diagnostic Tool (MSDT).

Also, recently we caught emotet using the technique to run VBS code via the LNK file [...]
Click to expand...

The features of the mLNK builder include bypassing the following solutions:

Windows Defender

Windows Defender Memory

Windows Defender Cloud Scanner

Smart Screen Alert

AMSI and MUCH MORE!

Click to expand...

guest · Jan 19, 2023

New Research Delves into the World of Malicious LNK Files and Hackers Behind Them
By Ravie Lakshmanan - January 19, 2023

Cybercriminals are increasingly leveraging malicious LNK files as an initial access method to download and execute payloads such as Bumblebee, IcedID, and Qakbot.
Click to expand...

A recent study by cybersecurity experts has shown that it is possible to identify relationships between different threat actors by analyzing the metadata of malicious LNK files, uncovering information such as the specific tools and techniques used by different groups of cybercriminals, as well as potential links between seemingly unrelated attacks.

"With the increasing usage of LNK files in attack chains, it's logical that threat actors have started developing and using tools to create such files," Cisco Talos researcher Guilherme Venere said in a report shared with The Hacker News.
This includes tools like NativeOne's mLNK Builder and Quantum Builder, which allow subscribers to generate rogue shortcut files and evade security solutions.
Click to expand...

Specifically, multiple samples of LNK files leading to IcedID and Qakbot infections and those that were used in different Bumblebee campaigns have all been found to share the same Drive Serial Number.

LNK files have also been employed by advanced persistent threat (APT) groups like Gamaredon (aka Armageddon) in its attacks aimed at Ukrainian government entities.
Click to expand...

The noticeable spike in campaigns using malicious shortcuts is seen as a reactive response to Microsoft's decision to disable macros by default in Office documents downloaded from the Internet, prompting threat actors to embrace alternative attachment types and delivery mechanisms to distribute malware.
Click to expand...

Cisco Talos: Following the LNK metadata trail

By Guilherme Venere - January 19, 2023

Adversaries’ shift toward Shell Link (LNK) files, likely sparked by Microsoft’s decision to block macros, provides the opportunity to capitalize on information that can be provided by LNK metadata.

Cisco Talos analyzed metadata in LNK files and correlated it with threat actors tactics techniques and procedures, to identify and track threat actor activity. This report outlines our research on Qakbot and Gamaredon as examples.

Talos also used LNK file metadata to identify relationships among different threat actors. In this report we demonstrate this by using metadata to connect Bumblebee with IcedID and Qakbot respectively.

Click to expand...

Log in or Sign up

Shortcut-Based (LNK) Attacks Delivering Malicious Code On The Rise

guest Guest

guest Guest

Log in or Sign up

Shortcut-Based (LNK) Attacks Delivering Malicious Code On The Rise

guest Guest

guest Guest

Useful Searches