Following the LNK metadata trail
Summary: Cisco Talos observed threat actors shifting from malicious macros to LNK files for initial access after Microsoft began disabling macros by default in internet-downloaded Office documents in 2022, with LNK usage by major malware families rising steadily from the start of the year and spiking when the Office 365 changes took effect. Talos found that LNK metadata - drive serial numbers, user SIDs, MAC addresses and timestamps - can link samples across campaigns, tying the Qakbot "AA" and "BB" campaigns to the same drive serial number and connecting Glowsand LNK files to Gamaredon infrastructure dating back to 2017.
Bottom line: Qakbot's "AA" and "BB" campaigns share a drive serial number, and Gamaredon samples from 2017 carry the same LNK metadata as files seen in 2022 - meaning the shortcut files your users click can identify the specific machine and actor behind an intrusion long after the payload is gone.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026