LNK Malware Leverages Legit Windows Files to Slip Past Defenses

In a campaign described by GBHackers On Security, LNK malware is being used to deliver a Remote Access Trojan by reviving Windows shortcut (.LNK) files and LOLBins such as odbcconf.exe. The attack chain starts when victims download a file named “cyber security.lnk” from a Discord channel, while a decoy PDF titled “Cyber Security.pdf” hides the malicious activity and a hidden PowerShell sequence runs in the background.

The malware then uses conhost.exe in headless mode to execute PowerShell, creates a working directory under C:\Users\Public\Nuget, and extracts a ZIP containing Moq.dll and helper libraries before launching the RAT. It registers Moq.dll via odbcconf.exe, patches AMSI and ETW logging, and decodes commands from a C2 server, with AES-encrypted modules decrypted at runtime.

Finally, the RAT persists by modifying a registry key to launch at login and can exfiltrate system metrics, screenshots, and files via a hard-coded C2 URL, illustrating its multi-functional espionage capabilities.