Cyber Security News

Hackers Deploy Weaponized LNK Files for Malicious Payload Delivery

Researchers reported a phishing attack on December 4th, 2024, where malicious emails purportedly from the Ukrainian Union of Industrialists and Entrepreneurs were distributed, inviting recipients to a NATO standardization conference. 

The emails aimed to compromise systems by delivering malware, and CERT-UA warns users to be cautious of unsolicited emails, especially those with attachments or links from unknown sources.

A phishing email that contained a malicious hyperlink was sent to a victim, and when the victim clicked on the hyperlink, it caused the victim to download a shortcut file that was named “list_02-1-437.lnk.” 

Upon execution, this LNK file initiated the download and launch of the “start.hta” file, leveraging the system’s mshta.exe utility, which posed a potential security risk to the victim’s system.

The HTA file is a malicious script that leverages PowerShell to download and execute harmful payloads, which initiates the download and opening of a deceptive USPP letter and concurrently downloads a ZIP archive containing malicious files.

Leveraging 2024 MITRE ATT&CK Results for SME & MSP Cybersecurity Leaders – Attend Free Webinar

The execution of a BAT file, which occurs when these files are extracted to the local AppData directory, has the potential to compromise the system and steal data. 

Example of a chain of damage

Attack involves the deployment of a malicious script, “Registry.hta,” which is strategically placed in the autorun directory to ensure automatic execution upon system startup. 

The script initiates a series of actions, including the deletion of specific downloaded files and the subsequent launch of “update.exe,” a remote access Trojan (RAT) known as MESHAGENT and grants unauthorized remote control over the compromised system, enabling malicious activities such as data theft, surveillance, and further compromise.

The threat actor UAC-0185 (UNC4221) has been operational since at least 2022, targeting sensitive information from various platforms, as recent investigations have uncovered additional resources linked to the group, suggesting prolonged and sophisticated cyberattacks. 

According to CERT-UA, the group’s primary objectives include compromising messaging applications like Signal, Telegram, and WhatsApp, as well as military systems such as DELTA, TENETA, and Kropyva, to exfiltrate valuable credentials and sensitive data.

Cybercriminals are launching targeted attacks against employees of Ukrainian defense-industrial complex enterprises and the Defense Forces, which, though less widespread, aim to compromise systems using specialized tools like MESHAGENT and ULTRAVNC. 

Intrusions that are successful allow for unauthorized remote access to the computers of their victims, which may result in the theft of data, disruption of the system, or additional activity that is malicious. 

Investigate Real-World Malicious Links, Malware & Phishing Attacks With ANY.RUN – Try for Free

Aman Mishra

Aman Mishra is a Security and privacy Reporter covering various data breach, cyber crime, malware, & vulnerability.

Recent Posts

Secure Ideas Achieves CREST Accreditation and CMMC Level 1 Compliance

Secure Ideas, a premier provider of penetration testing and security consulting services, proudly announces its…

1 hour ago

New Phishing Campaign Targets Investors to Steal Login Credentials

Symantec has recently identified a sophisticated phishing campaign targeting users of Monex Securities (マネックス証券), a…

1 hour ago

UAC-0219 Hackers Leverage WRECKSTEEL PowerShell Stealer to Extract Data from Computers

In a concerning development, CERT-UA, Ukraine's Computer Emergency Response Team, has reported a series of…

1 hour ago

Hunters International Linked to Hive Ransomware in Attacks on Windows, Linux, and ESXi Systems

Hunters International, a ransomware group suspected to be a rebrand of the infamous Hive ransomware,…

2 hours ago

Qilin Operators Imitate ScreenConnect Login Page to Deploy Ransomware and Gain Admin Access

In a recent cyberattack attributed to the Qilin ransomware group, threat actors successfully compromised a…

2 hours ago

Operation HollowQuill Uses Malicious PDFs to Target Academic and Government Networks

A newly uncovered cyber-espionage campaign, dubbed Operation HollowQuill, has been identified as targeting academic, governmental,…

2 hours ago