Detected LNK_DLOADR over a 4 month period The steep rise shows how popular this method is becoming:įigure 1. To illustrate how the trend of using LNK files is rising, note how one single LNK malware (identified by Trend Micro as LNK_DLOADR.*) has had a significant jump in detections since January 2017. Now, we’re seeing an increase in attacks that leverage malicious LNK files that use legitimate apps-like PowerShell-to download malware or other malicious files. zip to disguise a LNK file attachment that led to the Locky ransomware. And in early 2017, we noted how Trojan downloaders used a. LNK was actually already used as an attack vector as early as 2013. LNK files are usually seen by users as shortcuts, and used in places like the Desktop and Start Menu. However, cybercriminals are staying ahead of the curve by using alternative means of executing PowerShell script-Windows LNK (LNK) extensions. Because this seemed to be an upward trend, security administrators became more familiar with how to prevent PowerShell scripts from doing any damage. There were a few notable instances where cybercriminals abused PowerShell: in March 2016 with the PowerWare ransomware, and in a new Fareit malware variant in April 2016. All told, it makes an attractive tool for threat actors. It runs discreetly in the background, and can be used to obtain system information without an executable file. PowerShell is a versatile command-line and shell scripting language from Microsoft that can integrate and interact with a wide array of technologies. Update as of May 30, 2017, 5:00 AM CDT to update the date referencing Trojan downloaders that used.

Create lnk file