LNK malware Archives • Daily CyberSecurity

Kimsuky Spear Phishing Targets Ukrainian Diplomacy and Security Experts in Operation GitPower

Kimsuky spear phishing email with fake KCSCON speaker invitation targeting Ukrainian experts in Operation GitPower

Kimsuky Spear Phishing Targets Ukrainian Diplomacy and Security Experts in Operation GitPower

Do Son October 13, 2026

Kimsuky spear phishing lures target Ukrainian security experts with fake invitations, as Operation GitPower abuses GitHub and GitLab.

APT-C-60 Attacks Target Japan With SpyGlace Malware APT-C-60 attacks on Japan using LNK files and legitimate services to deploy SpyGlace malware

APT-C-60 Attacks Target Japan With SpyGlace Malware

Do Son July 18, 2026

JPCERT/CC details new APT-C-60 attacks on Japan. The group abuses Proton Drive, LNK files, and GitHub to deploy SpyGlace malware.

Clubfoot Wolf Hits Russian Firms With NetSupport Manager exfiltrating AWS credentials - fabrice package

Clubfoot Wolf Hits Russian Firms With NetSupport Manager

Do Son July 15, 2026

Clubfoot Wolf targets Russian companies with phishing that drops NetSupport Manager as a stealthy remote access tool, BI.ZONE reports.

Node.js Backdoor Hides Its C2 on the TON Blockchain Mercenary Akula European Financial Targeting AI-Generated Malware React2Shell Exploit UAT-8837 Critical Infrastructure Attack APT36, BOSS Linux BRICKSTORM Malware, China Espionage Curly COMrades, MucorAgent Chinese APT - HTTP Client Tools Shuckworm Cyber Espionage

Mercenary Akula European Financial Targeting AI-Generated Malware React2Shell Exploit UAT-8837 Critical Infrastructure Attack APT36, BOSS Linux BRICKSTORM Malware, China Espionage Curly COMrades, MucorAgent Chinese APT - HTTP Client Tools Shuckworm Cyber Espionage

Node.js Backdoor Hides Its C2 on the TON Blockchain

Do Son July 15, 2026

A LNK phishing attack drops a Node.js backdoor and hides its C2 on the TON blockchain using EtherHiding, LevelBlue reports.

New Phishing Campaign Abuses GitHub to Target South Korea GitHub C2 LNK Malware

New Phishing Campaign Abuses GitHub to Target South Korea

Do Son April 9, 2026

FortiGuard Labs unmasks a South Korean espionage wave abusing the GitHub API for C2 and using LNK files to stay invisible. Protect your network from LotL.

Operation Covert Access: Rust RAT Infiltrates Argentina’s Judiciary WhatsApp Worm, Brazilian Banking Trojan LAPSUS$ Alliance, Scattered Spider Ransomware, Cybercrime RedCurl APT group Russian Cyberespionage, ApolloShadow Malware

WhatsApp Worm, Brazilian Banking Trojan LAPSUS$ Alliance, Scattered Spider Ransomware, Cybercrime RedCurl APT group Russian Cyberespionage, ApolloShadow Malware

Operation Covert Access: Rust RAT Infiltrates Argentina’s Judiciary

Do Son January 21, 2026

Seqrite exposes "Operation Covert Access": A Rust RAT targeting Argentina's legal system via fake court rulings. Includes anti-analysis & encryption tools.

“Nomad Leopard” Spotted in the Wild: Cyber Espionage Campaign Targets Afghan Government Nomad Leopard Afghanistan Cyber Espionage

“Nomad Leopard” Spotted in the Wild: Cyber Espionage Campaign Targets Afghan Government

Do Son January 20, 2026

Nomad Leopard targets Afghan officials with fake ministry docs. SEQRITE reveals how the "afghanking777000" OPSEC fail exposed the spies.

Transparent Tribe Weaponizes “JLPT” Tests in New Cyber-Espionage Campaign Against India Operation IconCat, UNG0801 AFP cyberattack -NetWalker Ransomware VShell RAT

Operation IconCat, UNG0801 AFP cyberattack -NetWalker Ransomware VShell RAT

Transparent Tribe Weaponizes “JLPT” Tests in New Cyber-Espionage Campaign Against India

Do Son January 5, 2026

CYFIRMA unmasks APT36's latest campaign: a fake JLPT exam lure using fileless LNK malware to evade antivirus and spy on Indian government targets.

APT-36 Uses Fake “WhatsApp Fraud” Advisory to Hack Government Systems TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

APT-36 Uses Fake “WhatsApp Fraud” Advisory to Hack Government Systems

Do Son December 24, 2025

CYFIRMA exposes APT-36 weaponizing a fake NCERT WhatsApp advisory to deliver a stealthy backdoor and seize long-term control of government systems.

New LNK Malware Uses Windows LOLBins to Evade Detection Kali365 phishing platform EmEditor Supply Chain Attack, WALSHAM INVESTMENTS LIMITED EggStreme, fileless malware North Korea Cybercrime, Remote IT Job Fraud RedDelta APT

Kali365 phishing platform EmEditor Supply Chain Attack, WALSHAM INVESTMENTS LIMITED EggStreme, fileless malware North Korea Cybercrime, Remote IT Job Fraud RedDelta APT

New LNK Malware Uses Windows LOLBins to Evade Detection

Do Son September 25, 2025

A new campaign uses a malicious LNK shortcut sent via Discord to deploy a multi-functional RAT that hijacks legitimate Windows binaries to evade detection.