Loading story…
Threat actors increasingly replaced macro-enabled Office documents with Windows shortcut (.LNK) files, ISO images, and HTML smuggling to gain initial access on Windows systems after Microsoft tightened macro protections and as adversaries sought ways around Mark-of-the-Web controls, including CVE-2022-41049. Fortinet reported phishing campaigns in 2022 delivering Emotet, Qbot/QakBot, IcedID, and Bumblebee through Excel 4.0 macros early on, then shifting to LNK files, ISO containers, and browser-reconstructed payloads that launched malware via native tools such as
powershell
mshta.exe
regsvr32.exe
rundll32.exe
curl
cmd.exe
A separate Fortinet investigation detailed a QakBot campaign in which an attached HTML file dropped a ZIP archive containing a malicious LNK that fetched a loader DLL and executed the core malware filelessly inside a hollowed process.
Cisco Talos found that the growing use of malicious LNK files also created a forensic trail: embedded metadata such as Drive Serial Number, MachineID, DROID GUIDs, timestamps, paths, and SIDs can link campaigns and expose the systems used to build the shortcuts. Talos used Qakbot and Gamaredon examples to show how LNK metadata supports clustering and hunting, and identified metadata-based ties between Bumblebee, IcedID, and Qakbot, suggesting shared tooling or operational overlap. Earlier Fortinet reporting showed LNK-based phishing was already being used in espionage operations, including a campaign targeting Ukrainian government entities with ZIP archives containing malicious shortcuts, reinforcing that LNK files had become a versatile delivery mechanism for both financially motivated malware and state-linked intrusion activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
22 events from the most recent confirmed update back to the earliest known activity.
Cisco Talos published research showing how metadata embedded in malicious Windows LNK files can be used to cluster campaigns, track operators, and reveal links between malware ecosystems. The report also described metadata-based relationships connecting Bumblebee with IcedID and Qakbot.
Cisco Talos said a later spike in LNK-file usage around October and November 2022 may have been influenced by vulnerabilities that bypassed the Mark-of-the-Web flag. The report cites these bypasses as another factor encouraging malicious attachment shifts.
Cisco Talos observed that the Qakbot BB campaign began showing metadata-wiping behavior on September 13, 2022. This mirrored the wiping already seen in the Obama campaign.
Talos found that some Gamaredon-linked samples identified on September 6 contained an embedded digital signature string referencing 'Microsoft Operations Puerto Rico1.' The string was likely garbage data inserted to confuse antivirus scanners.
Talos found that earlier September Qakbot BB campaign samples still contained Drive Serial Number information matching the AA campaign. This suggested the AA and BB campaigns were probably managed by the same group.
Cisco Talos said metadata correlation helped identify a new Gamaredon campaign targeting Ukrainian organizations beginning around August 8, 2022. Talos used LNK metadata to connect the activity to prior Gamaredon-linked samples.
Talos observed that starting in August 2022, the Qakbot Obama campaign wiped metadata from its LNK files. Despite the wiping, the Target field still pointed to JS, BAT, or CMD files used to launch the malicious DLL chain.
FortiGuard Labs analyzed a phishing campaign spreading a new QakBot variant through an attached HTML file that dropped a ZIP archive containing a malicious LNK. The shortcut used cmd.exe, curl, and regsvr32 to download and run a QakBot loader DLL, which then deployed the core module filelessly.
FortiGuard Labs published research describing active Q2 2022 phishing campaigns that evolved from Excel droppers to LNK files, ISO files, and HTML smuggling. The report tied the shift to Microsoft's tighter macro protections and attackers' preference for formats that better evade Mark-of-the-Web controls.
Cisco Talos said Microsoft re-enabled the macro-blocking changes by the end of July 2022. Talos observed a major spike in LNK-file usage around the period when these changes were in effect.
Cisco Talos said Microsoft removed the Office macro-blocking feature later in June 2022 after initially implementing it. Talos cited this sequence as part of the broader shift in attacker delivery methods during 2022.
By June 2022, FortiGuard Labs observed HTML smuggling files being sent directly as HTML attachments rather than only via download links. The campaigns continued delivering malware families including Emotet, Qbot, Icedid, and Bumblebee.
Talos analyzed multiple Qakbot AA campaign samples from June and July 2022 and found they were created on a machine with Drive Serial Number 0x2848e8a8. The same serial number also appeared in other malware-related samples, including one flagged as a RedLine variant.
Cisco Talos found that LNK metadata from a June 2022 Inquest report on the Glowsand threat actor linked to files associated with the Gamaredon APT. The correlation showed how LNK artifacts could connect apparently separate activity clusters.
Cisco Talos said Microsoft implemented macro-blocking changes for internet-downloaded Office documents around June 2022. Talos linked this change to increased attacker use of LNK files as initial access vectors.
FortiGuard Labs first observed phishing campaigns using HTML smuggling download links in May 2022. The technique reconstructed malicious files locally in the victim's browser.
FortiGuard Labs observed ISO droppers appearing in the middle of May 2022. These ISO files contained hidden malware DLLs and malicious LNK files used to launch payloads.
FortiGuard Labs reported that Qbot and IcedID began spreading through malicious Windows shortcut files in early May 2022. This marked a shift away from earlier Excel-based droppers.
FortiGuard Labs observed an Emotet attack technique using malicious LNK files for delivery. The report states this technique first appeared on April 23, 2022.
FortiGuard Labs observed Excel files as the only dropper type in early April 2022 in phishing-delivered malware campaigns targeting Windows users. These campaigns delivered malware including Emotet and Qbot.
FortiGuard Labs reported a spearphishing campaign using COVID-21 and Urgent Update lures against security-related entities within the Ukrainian government. The activity delivered ZIP archives with malicious LNK files, a Word exploit for CVE-2017-11882, AutoIT-based theft malware, and Saint_v3.
Cisco Talos and Fortinet both describe QakBot as an active malware operation first observed or analyzed around 2007.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
blog.talosintelligence.com
Open sourcefortinet.com
Open sourcefortinet.com
Open sourcefortinet.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are increasingly abusing Windows shortcut files (`.LNK`) as a low-friction mechanism for initial access, payload execution, and persistence across phishing and archive-based intrusion chains. Multiple reports describe attackers disguising LNKs as PDFs, resumes, project files, or document shortcuts inside ZIP, RAR, ISO, and IMG containers, then using them to launch LOLBins and scripts such as `powershell.exe`, `mshta.exe`, `regsvr32.exe`, `rundll32.exe`, `cmd.exe`, and `MSBuild.exe`. Campaigns tied to QakBot, Emotet, Bumblebee, MORE_EGGS, Gamaredon, APT37, Higaisa, and likely APT41/Winnti used LNK-triggered chains to download payloads, execute JavaScript or PowerShell, establish scheduled-task or Startup-folder persistence, and deploy stealers, RATs, and backdoors. Researchers note the trend accelerated after Microsoft blocked internet-downloaded Office macros by default, pushing operators toward shortcut-based delivery. Defenders are being urged to inspect the LNK `Target` field and underlying Shell Link structures for suspicious command lines, embedded URLs or IPs, oversized files, and metadata anomalies such as mismatched `TrackerDataBlock` MAC information. Microsoft’s Shell Link specification provides the file-format baseline, while incident-response guidance highlights that `explorer.exe` often appears as the parent process, making file telemetry and LNK creation events critical for hunting. Analysts also point to builder ecosystems such as **mLNK Builder** that lower the barrier for criminal use and improve evasion, alongside older LNK-related exploitation history including `CVE-2010-2568`, which allowed code execution when Windows rendered crafted shortcut icons. Together, the reporting shows `.LNK` files have become a durable and versatile attack primitive spanning commodity malware, espionage operations, and persistence tradecraft.
Aug 15, 2026
Threat actors increasingly used **Virtual Hard Disk (`.vhd`) files** in phishing and malware delivery chains, replacing earlier ISO and IMG containers to improve evasion and execution. AhnLab documented a **Qakbot** campaign in which an HTML attachment generated a password-protected archive containing a VHD; when mounted, the image exposed a malicious LNK and scripts that ultimately launched `rundll32` to load a DLL, inject into `wermgr.exe`, contact command-and-control servers, and enable follow-on payload delivery and financial data theft. Check Point separately observed the **Bumblebee** loader adopting VHD-based delivery with PowerShell download logic before later alternating between ISO and VHD containers with embedded DLLs, while tailoring second-stage payloads to victim environments. Forensic analysis of a malicious sample named **`invoice.vhd`** showed why the format is attractive to operators: the mounted image contained a lure file, **`invoice.pdf.lnk`**, that launched obfuscated PowerShell to fetch and execute an HTA payload from `transfer[.]sh`, and the VHD preserved deleted artifacts revealing repeated reuse of the same container for JavaScript, VBS, SCR, EXE, BAT, and PIF payload staging. Residual files in `$RECYCLE.BIN` and metadata such as an `IndexerVolumeGuid` linked the image to broader attacker tradecraft, including prior payload distribution through Discord CDN links and recurring VBS-to-PowerShell execution chains, underscoring how VHD files can both bypass **Mark of the Web** protections and serve as reusable malware delivery containers.
Aug 15, 2026
Attackers distributed malicious Windows shortcut (`.LNK`) files disguised as privacy consent forms and other work-related documents, tricking users into launching obfuscated PowerShell that fetched additional payloads from external infrastructure. Reporting indicates GitHub was used as a covert stage in the infection chain, helping operators blend malicious downloads and command retrieval into legitimate web traffic while keeping much of the activity fileless and in memory. Once executed, the malware created downloader and loader scripts, established persistence through Windows Task Scheduler, opened decoy documents to reduce suspicion, and deleted the original shortcut to limit forensic artifacts. Observed follow-on payloads included an information stealer and a backdoor loader that decrypted and loaded malware into memory; the theft activity gathered host, security product, network, IP, drive, file, and process data, with behavior resembling prior **Kimsuky**-linked operations.
Jun 29, 2026