Phishing campaigns using Windows LNK files and PowerShell loaders to deliver RATs and ransomware

Multiple recent intrusion reports describe phishing-led Windows compromises that rely on weaponized .LNK shortcuts to trigger obfuscated PowerShell execution, display decoy documents, and then fetch additional payloads from public cloud/code platforms. In South Korea, attackers distributed an LNK disguised as financial trading guidance that opens a decoy PDF while running PowerShell; subsequent stages perform anti-analysis/virtualization checks, establish persistence, and retrieve a masked executable from GitHub that decrypts code at runtime to run MoonPeak malware. Researchers assessed the activity as likely North Korea–linked based on GitHub commit metadata and naming patterns.

A separate Russia-targeted campaign used business-themed archives containing decoy documents and a malicious LNK to pull a PowerShell loader that establishes persistence and then weakens defenses (including Microsoft Defender exclusion changes and use of defendnot), performs reconnaissance, and tampers with system tooling and file associations before deploying Amnesia RAT (fetched from Dropbox) and a Hakuna Matata–derived ransomware payload for encryption. By contrast, reporting on KazakRAT describes a different espionage operation in Kazakhstan/Afghanistan delivered via malicious MSI installers and using simple, unencrypted HTTP C2; it is not part of the LNK/PowerShell delivery chains described in the other incidents.