Sidewinder Hackers Exploit LNK Files to Deploy Malicious Scripts

According to 360 Advanced Threat Research Institute, the Sidewinder APT group, also known as APT-C-24 or “Rattlesnake”, has adopted a new delivery method using Windows shortcut (LNK) files to orchestrate multi-stage intrusions across South Asia. Active since at least 2012, the group has targeted governments, energy utilities, military installations and mining operations in Pakistan, Afghanistan, Nepal, Bhutan and Myanmar.

Researchers uncovered a series of compressed archives containing three malicious LNK files, masquerading as benign documents with filenames such as “file 1.docx.lnk”, “file 2.docx.lnk”, and “file 3.docx.lnk”, which, when executed, invoke mshta.exe to fetch and run an obfuscated JScript payload from a remote URL parameterised by “yui=0,1,2”.

The attack uses a two-stage process where the JScript reveals a disguised payload and a subsequent .NET component decompresses and deobfuscates content in memory, avoiding disk-based artefacts to hinder detection. The downloader then performs environment checks (CPU cores, memory), looks for security products like Kaspersky or ESET NOD32, and appends detected names to its C2 URL before retrieving and decrypting further payloads for remote control.

The campaign continues to mirror Sidewinder’s infrastructure patterns, with C2 domains such as policy.mail163cn[.]info resolving to IP 89.150.45[.]75 and LNK files ending with dual suffixes, underscoring attribution to the Rattlesnake-backed Sidewinder operations.