DarkSamural APT Group Deploys LNK/PDF Malware to Steal Critical Information

DarkSamural, a newly identified subspecies of the OceanLotus APT, has launched a campaign targeting high-value organisations in Pakistan, using malicious LNK files masquerading as PDF documents and MSC containers powered by GrimResource technology to deliver a multi-stage payload designed to exfiltrate data.

After analysis, researchers describe DarkSamural’s operations as a false-flag undertaking orchestrated by Patchwork, also known as APT Group 72, which has historically targeted military, diplomatic, educational and scientific research institutions across China, Pakistan and Bangladesh. The attackers exploit Windows MSC files, disguising them with PDF icons, and upon opening the container invoke mmc.exe to load an ActiveX object that fetches and executes payloads from remote command-and-control servers.

The campaign employs a toolkit including BADNEWS RAT, QuasarRAT, AsyncRAT, Mythic, Remcos RAT and NorthStarC2 to maintain persistence and command-and-control across infected hosts. Initial compromise hinges on deceptive emails with a compressed archive labeled “Drone_Information.pdf[.]msc,” with the second stage delivering a file named Drone_Information.pdf to a user directory and spawning a multi-layered JavaScript payload.

The Mythic agent, compiled on 29 May 2025, communicates with its C2 at a CloudFront URL and uses AES-HMAC and AES-128-GCM for encryption, while persistence is achieved through scheduled tasks named MicrosoftEdgeUpdateTaskMachineCoreXUI and startup entries.