Fast Facts
- Threat actors utilize deceptive LNK shortcut files with obfuscated PowerShell scripts to stealthily download and execute malicious code in memory, evading detection.
- Malicious scripts modify external files, establish persistence via scheduled tasks, and employ decoy documents, making infection hard to identify.
- The malware conducts information theft and establishes backdoors, enabling ongoing access and further malicious activities on infected systems.
Threat, Attack Techniques, and Targets
Recent evidence shows that malicious files disguised as “Consent Forms for the Collection and Use of Personal Information” are circulating. These files are actually shortcut files (.LNK files). When a user runs them, they execute a malicious PowerShell script hidden inside. The script is obfuscated and downloads more malicious scripts from external sources. These scripts run in memory, making them hard to detect. The threat actors also alter these scripts periodically, decrypting and executing obfuscated code. They create additional scripts on the PC that act as downloaders and loaders. These scripts run repeatedly using Windows Task Scheduler, even after reboots. The malware also uses decoy documents to hide its activity. Besides, the files can download other malicious files, such as PowerShell scripts that steal information or serve as backdoors. The main targets are individual PCs and organizational networks, often aimed at stealing data or maintaining persistent control.
Impact, Security Implications, and Remediation Guidance
This malware can cause serious damage. It gathers detailed information from the infected PC, such as system details, network info, and running processes. This data helps threat actors plan their next move. The malware also installs backdoors, allowing attackers to regain access for further malicious actions. Such threats can lead to data theft, system compromise, and prolonged unauthorized access. Because the attack uses legitimate features like Task Scheduler and PowerShell, it is difficult to detect without detailed monitoring. To stay protected, users should avoid running files from unknown sources. It is important to verify file extensions and delivery paths carefully. Security teams should check for suspicious Task Scheduler entries, abnormal PowerShell scripts, and unusual external connections. If an infection is suspected, remediation steps should be taken based on guidance from trusted security vendors or authorities.
Expand Your Tech Knowledge
Learn how the Internet of Things (IoT) is transforming everyday life.
Stay inspired by the vast knowledge available on Wikipedia.
ThreatIntel-V1
