LNK-Based Malware Campaigns Deliver PlugX and Custom .NET RAT

Researchers documented two separate but related LNK-driven intrusion chains that used shortcut files as the initial lure to fetch additional malware from attacker-controlled infrastructure. In one campaign targeting organizations in the Arabian Gulf region, a China-nexus threat actor used a Middle East conflict-themed ZIP archive containing an LNK file that downloaded a malicious CHM file and ultimately deployed a PlugX backdoor. The infection chain progressed through a second LNK, a TAR archive, DLL sideloading, and a shellcode loader before installing PlugX with persistence under a fake Microsoft Display Broker path and service name. The malware used RC4-encrypted components, API hooking, reflective DLL loading, corrupted PE headers, and support for TCP, HTTPS, UDP, and DoH communications, with a decrypted command-and-control endpoint at 91.193.17[.]117:443 and plugins for keylogging, shell access, screen capture, registry, service, and network operations.

A second investigation exposed a live LNK-to-DLL-to-.NET RAT operation staged from an open Apache directory on wildishadventure[.]com/secure9/ and 171.22.182[.]231/secure9/, where researchers recovered weaponized LNK files, custom DLL downloaders, backup files, and a final payload named RemoteMgmt.Agent.exe. That chain abused the legacy ActiveXObject('htmlfile') technique to force Windows to retrieve DLLs over UNC paths, then delivered a custom .NET 4.8 remote access trojan that supported command execution, token-based authentication, JSON-over-raw-TCP C2 over port 443, reconnect-based persistence, and logging to %TEMP%\rmgmt_agent.log. Operational security failures including exposed directory indexing, .old backups, test builds, and unstripped internal names allowed investigators to reconstruct the malware’s development workflow and identify infrastructure spanning BlueVPS, Namecheap, and Cloudflare.