AhnLab ASEC blog (asec.ahnlab.com)
LNK File Disguised as Certificate Distributing RokRAT Malware · 2024-04-23
excerpt: AhnLab SEcurity intelligence Center (ASEC) has confirmed the continuous distribution of shortcut files (*.LNK) of abnormal sizes that disseminate backdoor-type malware. The recently confirmed shortcut files (*.LNK) are found to be targeting South Korean users, particularly those related to North Korea. The confirmed LNK file names are as follows: National Information Academy 8th Integrated Course | attribution sentence: The confirmed LNK file names are as follows: National Information Academy 8th Integrated Course Certificate (Final).lnk Gate access roster 2024.lnk Northeast Project (US Congressional Research Service (CRS Report).lnk Facility list.lnk The confirmed LNK files contain a command to execute PowerShell via CMD, and their type is similar to the type found in “RokRAT Malware Distributed Through LNK File | target sentence: The recently confirmed shortcut files (*.LNK) are found to be targeting South Korean users, particularly those related to North Korea.