Loading story…
Proofpoint reported that threat actor TA554 ran sustained email campaigns targeting organizations and users in the United Kingdom, Italy, and Canada, using localized package-delivery and order-notification lures to distribute malware. The campaigns relied heavily on zipped .LNK shortcut files, a Windows Shell Link format documented by Microsoft, to start the infection chain and launch PowerShell-based retrieval of additional payloads. TA554 also applied geofencing and personalization throughout the operation to improve targeting and reduce unnecessary exposure.
Once executed, the sLoad downloader performed broad host reconnaissance, including process enumeration, checks for Outlook and Citrix artifacts, DNS-cache inspection for banking domains, screenshot capture, and support for loading external binaries. Proofpoint said sLoad beaconed to command-and-control infrastructure over HTTP, reported victim details through request parameters, polled for follow-on commands, and could update itself; in many cases it later delivered the Ramnit banking trojan after a delay. The actor also evolved its tradecraft during the campaign, shifting from LNK files that fetched intermediate PowerShell stages to LNK files that downloaded sLoad directly.
Get the infrastructure and lures behind it.
6 events from the most recent confirmed update back to the earliest known activity.
Microsoft published analysis of sLoad version 2.0, which it called 'Starslord,' describing new infection-stage tracking and a checkUniverse anti-analysis mechanism that separates suspected analyst machines from real victims. The research also noted that non-trapped hosts were intermittently receiving the Ramnit file infector.
Proofpoint observed sLoad version 5.08b on 2018-10-03, indicating continued iteration of the downloader during the campaign.
Proofpoint reported seeing sLoad version 0.01b on 2018-05-01, providing an early dated anchor for the malware's development and use in the campaign.
Proofpoint researchers observed TA554 using the PowerShell downloader sLoad in email campaigns beginning in May 2018. These campaigns primarily targeted recipients in the United Kingdom, Italy, and Canada and often used localized package-delivery or order-notification lures.
Cybereason investigated a customer intrusion in which an Italian spam campaign delivered the sLoad downloader and ultimately a Ramnit banking Trojan variant. The report detailed abuse of LOLBins including PowerShell, BITSAdmin, and certutil, plus persistence, reconnaissance, screenshot exfiltration, Citrix ICA file hunting, and reflective injection components used by Ramnit.
Proofpoint published research detailing sustained TA554 campaigns using sLoad to deliver malware including Ramnit, along with technical analysis of the infection chain, geofencing, reconnaissance, and command-and-control behavior.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 57 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
5 references tracked. Mallory keeps watching after this page renders.
msdn.microsoft.com
Open sourcecybereason.com
Open sourcemicrosoft.com
Open sourceproofpoint.com
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple recent intrusion reports describe **phishing-led Windows compromises** that rely on **weaponized `.LNK` shortcuts** to trigger **obfuscated PowerShell** execution, display decoy documents, and then fetch additional payloads from public cloud/code platforms. In South Korea, attackers distributed an LNK disguised as financial trading guidance that opens a decoy PDF while running PowerShell; subsequent stages perform anti-analysis/virtualization checks, establish persistence, and retrieve a masked executable from **GitHub** that decrypts code at runtime to run **MoonPeak** malware. Researchers assessed the activity as likely **North Korea–linked** based on GitHub commit metadata and naming patterns. A separate Russia-targeted campaign used business-themed archives containing decoy documents and a malicious LNK to pull a PowerShell loader that establishes persistence and then weakens defenses (including **Microsoft Defender exclusion changes** and use of **`defendnot`**), performs reconnaissance, and tampers with system tooling and file associations before deploying **Amnesia RAT** (fetched from **Dropbox**) and a **Hakuna Matata–derived ransomware** payload for encryption. By contrast, reporting on **KazakRAT** describes a different espionage operation in Kazakhstan/Afghanistan delivered via malicious **MSI** installers and using simple, unencrypted HTTP C2; it is not part of the LNK/PowerShell delivery chains described in the other incidents.
Jun 29, 2026
Attackers distributed malicious Windows shortcut (`.LNK`) files disguised as privacy consent forms and other work-related documents, tricking users into launching obfuscated PowerShell that fetched additional payloads from external infrastructure. Reporting indicates GitHub was used as a covert stage in the infection chain, helping operators blend malicious downloads and command retrieval into legitimate web traffic while keeping much of the activity fileless and in memory. Once executed, the malware created downloader and loader scripts, established persistence through Windows Task Scheduler, opened decoy documents to reduce suspicion, and deleted the original shortcut to limit forensic artifacts. Observed follow-on payloads included an information stealer and a backdoor loader that decrypted and loaded malware into memory; the theft activity gathered host, security product, network, IP, drive, file, and process data, with behavior resembling prior **Kimsuky**-linked operations.
Jun 29, 2026
Researchers documented two separate but related **LNK-driven intrusion chains** that used shortcut files as the initial lure to fetch additional malware from attacker-controlled infrastructure. In one campaign targeting organizations in the **Arabian Gulf region**, a China-nexus threat actor used a Middle East conflict-themed ZIP archive containing an LNK file that downloaded a malicious CHM file and ultimately deployed a **PlugX** backdoor. The infection chain progressed through a second LNK, a TAR archive, DLL sideloading, and a shellcode loader before installing PlugX with persistence under a fake Microsoft Display Broker path and service name. The malware used RC4-encrypted components, API hooking, reflective DLL loading, corrupted PE headers, and support for **TCP, HTTPS, UDP, and DoH** communications, with a decrypted command-and-control endpoint at `91.193.17[.]117:443` and plugins for keylogging, shell access, screen capture, registry, service, and network operations. A second investigation exposed a live **LNK-to-DLL-to-.NET RAT** operation staged from an open Apache directory on `wildishadventure[.]com/secure9/` and `171.22.182[.]231/secure9/`, where researchers recovered weaponized LNK files, custom DLL downloaders, backup files, and a final payload named `RemoteMgmt.Agent.exe`. That chain abused the legacy `ActiveXObject('htmlfile')` technique to force Windows to retrieve DLLs over UNC paths, then delivered a custom .NET 4.8 remote access trojan that supported command execution, token-based authentication, JSON-over-raw-TCP C2 over port 443, reconnect-based persistence, and logging to `%TEMP%\rmgmt_agent.log`. Operational security failures including exposed directory indexing, `.old` backups, test builds, and unstripped internal names allowed investigators to reconstruct the malware’s development workflow and identify infrastructure spanning **BlueVPS**, **Namecheap**, and **Cloudflare**.
Jun 29, 2026