Following the LNK metadata trail

While tracking some prevalent commodity malware threat actors, Talos observed the popularization of malicious LNK files as their initial access method to download and execute payloads. A closer look at the LNK files illustrates how their metadata could be used to identify and track new campaigns.

access bumblebee campaigns commodity malware download files gamaredon identify initial access lnk malicious malware malware research metadata qakbot securex talos threat threat actors threats threat spotlight tracking