Talos Uses LNK Metadata to Track Malware Campaigns and Link Threat Actors
Summary
Cisco Talos analyzed LNK file metadata to track Qakbot and Gamaredon activity and link Bumblebee with IcedID and Qakbot, showing how metadata can reveal campaign relationships and help defenders improve detection.
Key points
- Talos observed malware operators increasingly using LNK shortcut files for initial access as they shifted away from macro-enabled Office documents.
- LNK fields such as timestamps, volume serial numbers, machine IDs, DROID GUIDs and metadata-store attributes can reveal where files were created and help correlate samples.
- Some builder tools leave machine-specific metadata, while others wipe fields; missing metadata can itself be a suspicious indicator.
- Talos used shared LNK metadata to associate Qakbot campaigns and connect Bumblebee samples with IcedID and Qakbot activity.
- LNK metadata linked files targeting Ukrainian organizations to Gamaredon activity; some samples also contained an apparent fake signature used to confuse antivirus scanners.
- The researchers say metadata correlation can support detection and tracking of adversary activity; the article also provides a YARA rule for identifying LNK files with wiped metadata.
Article Details
- Attack Vectors
- Malicious LNK files were used as initial-access attachments to download and execute payloads, including from ISO files.
- Gamaredon-related phishing emails with malicious documents and LNK files were used to download and execute second-stage payloads against Ukrainian organizations.
- Qakbot LNK files used target fields pointing to JS, BAT, or CMD files that started a malicious DLL infection chain.
- A sample associated with a Qakbot campaign contained PowerShell code that downloaded and executed a binary.
- Defensive Notes
- Inspect LNK metadata—including timestamps, VolumeID and drive serial number, MachineID, DROID GUIDs, and Metadata Store fields—to correlate samples and identify suspicious or reused creation environments.
- Flag LNK files with wiped metadata for investigation; the article notes that legitimate shortcuts normally contain metadata by default, while many malicious builder-generated files omit it.
- The article provides a YARA rule that checks for an LNK signature, zeroed timestamps, and selected target strings such as .js, .bat, or .cmd.
- Cisco reports that Secure Endpoint, Secure Web Appliance, Secure Email, Secure Firewall, Secure Malware Analytics, Umbrella, and Snort rules provide protections or detection relevant to the described threats.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 1b2ed05f488f8439688a02cc6ef84f939d16169117b489219b688a3ea482e5ed | Sample connected by LNK metadata to previous Gamaredon campaigns. |
| SHA256 | 1e0b92485e09ac970ae38214fb5c7407f73027ada47ea697017e49cacb576908 | Sample connected by LNK metadata to previous Gamaredon campaigns. |
| SHA256 | 2738ee3f181994cca5d9ea19359b8142981583d17563934ab3212eefe13af3ff | Sample reported to lead to a Bumblebee DLL. |
| SHA256 | 2f9da7145056a4217552a5a536ceb8365e853fbd04d28ae2d494afb20e9c021f | LNK sample listed as part of the Qakbot “AA” campaign. |
| SHA256 | 3cca8d1b4cfe0ebcf105621700454d0285ef1b44dfed3e3abf70060bb62aa5b4 | LNK file reported to lead to an IcedID DLL. |
| SHA256 | 52458b4aaddbcb04048be963ea7d669c2ff7a69642d027f88812a5c6c1ade955 | LNK sample listed as part of the Qakbot “AA” campaign. |
| SHA256 | 54681cbb4c61dd4fe03341cfd8d2b796366a0372b53dd3e1d52c9e6ff98692d1 | LNK sample listed as part of the Qakbot “AA” campaign. |
| SHA256 | 6161c01fd590c98c6dee4e510ba9be4f574c9cc5c89283dbff6bb79cd9383d70 | Sample identified by VirusTotal as a Redline variant. |
| SHA256 | 67bbffb2ff5f724a201445f26018cb09fbf0588689f98f90fd82082aae7c6eec | LNK sample listed as part of the Qakbot “AA” campaign. |
| SHA256 | 6a980d7659efb8bfb997dec3259d6eb090d4e6a4609e4c0666e04ad612151d71 | LNK sample listed as part of the Qakbot “AA” campaign. |
| SHA256 | 6ce64dedbe81c36aef38fd2d567f6ab9737df708591dc2f0cafa56db26a1d043 | Sample connected by LNK metadata to previous Gamaredon campaigns. |
| SHA256 | 7ba3eaee591cc73ab85aeb09d8c02b1e569b9dcaffcbc7c4473f504f939697d2 | LNK sample listed as part of the Qakbot “AA” campaign. |
| SHA256 | 7f66f4411983001d29236c5d3fb4ff26f01b5742badca1db8d49264c01ba506c | Sample connected by LNK metadata to previous Gamaredon campaigns. |
| SHA256 | 8fda14f91e27afec5c1b1f71d708775c9b6e2af31e8331bbf26751bc0583dc7e | LNK sample listed as part of the Qakbot “AA” campaign. |
| SHA256 | 9c7e01c2c39dadc020a0cf8dc74b62e6453b56413f09705b4ad4d391981f5a3f | LNK file reported to lead to a Bumblebee DLL. |
| SHA256 | a7f31c98147d98ac08f4b8afe7faa2f2b4aab821655717f4bde519fcd87300ac | LNK sample listed as part of the Qakbot “AA” campaign. |
| SHA256 | beacb63904c2624ae02601f283671b3ef61650109aea3259b63a0aeefe4133fa | Sample associated with the Qakbot campaign metadata contained PowerShell code to download and execute a binary. |
| SHA256 | c5c0daaa26815bb6528332dd4f56f7eb72db4456d5a84b8bc69239c45079a1c4 | LNK sample listed as part of the Qakbot “AA” campaign. |
| SHA256 | c9dfafd3536977289b4bfda1369fbd113a778cf06ac0c01cdc8e00e1c300e774 | LNK sample listed as part of the Qakbot “AA” campaign. |
| SHA256 | da2a0d9a6b5dd2123c4c2cbd55d81fd22ab72bf7ceb1489a5a770e10bcf67137 | LNK sample listed as part of the Qakbot “AA” campaign. |
| SHA256 | e818b0115a9a877a9517c99b16e5a2df9cf7c5eb1fb249d9153b68e8fa94e60b | LNK sample listed as part of the Qakbot “AA” campaign. |
| SHA256 | e89cd1999517b47805106111e14de4a03669cac30adb3b3304655febce25955f | LNK-related sample submitted with a BAT and DLL; the DLL was identified as an IcedID bot. |
| SHA256 | efdb91497fe213e8f696065c2fe81f64cbaa219da16e2b3f8e1e146d098652b5 | LNK sample listed as part of the Qakbot “AA” campaign. |
| URL | hxxp[:]//88[.]198[.]148[.]231/u[.]exe | URL from which the Qakbot-associated sample's PowerShell code downloaded a binary. |
MITRE ATT&CK
T1059.001 · PowerShellA Qakbot-associated sample contained PowerShell code that downloaded and executed a binary.T1105 · Ingress Tool TransferLNK files and associated scripts were used to download payloads, including binaries and second-stage payloads.T1566.001 · Spearphishing AttachmentGamaredon-related phishing emails carried malicious documents and LNK files used to deliver payloads.
CVE
People
Threat Actors
Malware
BazarLoaderLnk.Trojan.BazarLoaderBumbleBeeTalos also used LNK file metadata to identify relationships among different threat actors. In this report we demonstrate this by using metadata to connect Bumblebee with IcedID and Qakbot respectively.IcedIDTalos also used LNK file metadata to identify relationships among different threat actors. In this report we demonstrate this by using metadata to connect Bumblebee with IcedID and Qakbot respectively.Qakbotand procedures, to identify and track threat actor activity. This report outlines our research on Qakbot and Gamaredon as examples.Raspberry Robinas part of their initial infection chain. In general, LNK files are used by worm type malware like Raspberry Robin in order to spread to removable disks or network shares.RedLineAccording to VT information, this sample with hash 6161c01fd590c98c6dee4e510ba9be4f574c9cc5c89283dbff6bb79cd9383d70 is detected as a Redline variant (Figure 8):
Vendors
CiscoCisco Talos analyzed metadata in LNK files and correlated it with threat actors tactics techniques and procedures, to identify and track threat actor activity. This report outlines our research on Qakbot and GamaredonMicrosoftAdversaries’ shift toward Shell Link (LNK) files, likely sparked by Microsoft’s decision to block macros, provides the opportunity to capitalize on information that can be provided by LNK metadata.
Products
Microsoft Defender Antimalware Platformannouncement of vulnerabilities which allowed malware to bypass the Mark-of-the-Web flag used by Microsoft Defender and other Antivirus products to decide whether to scan or not a file. As reported by other sources,Microsoft WindowsMicrosoft describes the Shell Link binary file format - the format used by Windows files with the extension "LNK" - as a file which contains information that can be used by the Operating System or an application toOfficeMicrosoft announced at the beginning of 2022 that they would soon start to disable macros by default in Office documents downloaded from the Internet. They implemented the changes around June, only to remove the featureSecure EmailCisco Secure Email (formerly Cisco Email Security) can block malicious emails sent by threat actors as part of their campaign. You can try Secure Email for free here.Secure EndpointCisco Secure Endpoint (formerly AMP for Endpoints) is ideally suited to prevent the execution of the malware detailed in this post. Try Secure Endpoint for free here.Secure FirewallCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.Secure Malware AnalyticsCisco Secure Malware Analytics (Threat Grid) identifies malicious binaries and builds protection into all Cisco Secure products.Secure Web ApplianceCisco Secure Web Appliance web scanning prevents access to malicious websites and detects malware used in these attacks.SnortOpen-source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org. Snort SIDs for this threat are: 61099-61102, 300367-300368UmbrellaUmbrella, Cisco's secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs and URLs, whether users are on or off the corporate network. Sign up for a free trial of Umbrella here.
Tools
Cobalt Strike(CVE-2015-0096)In the LNK files created by Meterpreter, as well as other exploit frameworks like Cobalt Strike, the metadata are completely wiped, with the malicious code present in fields not normally parsed byLeCMDwhich we are going to use in this blog to demonstrate the examples, but there are other options like LeCMD or the Python library “LnkParse3”. Some of these tools are able to parse even malformed LNK files, whichLNK Parserpublic domain to parse and analyze the LNK structure. Google provides a free command line tool called “LNK Parser”, which we are going to use in this blog to demonstrate the examples, but there are other options likeLnk2pwnLnk2pwnLnkParse3in this blog to demonstrate the examples, but there are other options like LeCMD or the Python library “LnkParse3”. Some of these tools are able to parse even malformed LNK files, which is a characteristic of someLNKUpLNKUpMacroPackMacropackMeterpreterMeterpreter PayloadMLNK BuilderMLNK BuilderQuantum BuilderQuantum BuilderRustLnkBuilderRustLnkBuilderSharPersistSharPersistYARAall fields to be present, so they implement the bare minimum to have the malicious code running. A simple YARA rule could be used to detect such samples: