AhnLab ASEC blog (asec.ahnlab.com)
Distribution of Backdoor via Malicious LNK: RedEyes (ScarCruft) · 2023-09-01
excerpt: AhnLab Security Emergency response Center (ASEC) has confirmed that malware [1], which was previously distributed in CHM format, is now being distributed in LNK format. This malware executes additional scripts located at a specific URL through the mshta process. It then receives commands from the threat actor’s server to carry out additional malicious behaviors. The […] | attribution sentence: The malicious LNK file has been uploaded under the file name ‘REPORT.ZIP.’ Similar to the malware identified in < RokRAT Malware Distributed Through LNK Files (*.lnk): RedEyes (ScarCruft) > [2] , this file has an LNK that contains normal Excel document data and malicious script code.