Windows shortcut weaponized in Phorpiex-linked ransomware campaign

Source Domain: www.csoonline.com

Unlike many modern ransomware operations that rely on external command-and-control (C2) infrastructure, the Global Group payload executes locally once delivered, complicating detection and response efforts by traditional network-centric security controls, the researchers noted.

Weaponized LNK files

The infection chain begins with a user opening a shortcut file with a double extension, such as “Document.doc.lnk”. Because Windows hides file extensions by default, the file appears to the user as a legitimate document. The shortcut icon is also customized to resemble a Microsoft Word file to further reduce suspicion.

When executed, the .lnk file launches built-in Windows utilities, including cms.exe and PowerShell, to retrieve and execute the next-stage payload. Because no exploit is involved, this approach allows attackers to bypass security controls that focus on malicious documents or executable attachments.

Source