GAMAREDON CAMPAIGN ABUSES LNK FILES TO DISTRIBUTE REMCOS BACKDOOR

Summary from the TLDR InfoSec newsletter

Cisco Talos is tracking an ongoing campaign targeting users in Ukraine with malicious LNK files that resemble war-related files to eventually download the Remcos backdoor. The LNK files run a PowerShell command to launch a decoy file and download the second-stage zip file containing the backdoor. The second stage payload then uses DLL side-loading to execute the Remcos payload. Cisco believes that this campaign is associated with Gamaredon.