A campaign utilizing malicious LNK files is observed, targeting individuals with a background or interest in human rights issues. The attackers use MSBuild to deliver a stealthy, fileless backdoor payload, which enables them to execute commands and take control of infected systems. The campaign is attributed to the Turla APT group from Russia.
Table of contents
Key TakeawaysOverviewInfection chainTechnical AnalysisFinal Payload – Tiny BackdoorThreat Actor Attribution to Turla APT GroupConclusionRecommendationsMITRE ATT&CK® TechniquesIndicators of Compromise (IOCs)Yara ruleReferencesSort: