Operation Covert Access: Weaponized LNK-Based Spear-Phishing Targeting Argentina’s Judicial Sector to Deploy a Covert RAT

Summary

Seqrite identified a spear-phishing operation that delivers a weaponized LNK shortcut paired with a malicious BAT loader. Once executed, the loader pulls down a Rust-based remote access trojan from a GitHub repository, where it runs anti-analysis checks and establishes a resilient command-and-control channel. The activity is assessed to target Argentina’s judicial organizations and adjacent government entities. To increase the likelihood of execution, the attackers include legitimate-looking PDF decoy content in the delivery package.

Investigation

Analysts examined the ZIP archive containing the LNK, BAT, and PDF files, then reconstructed the PowerShell command sequence used to trigger the BAT loader. They profiled the RAT’s functionality, including anti-VM/anti-sandbox checks, host reconnaissance and system fingerprinting, persistence setup, and encrypted tasking over C2. The observed behaviors were mapped to relevant MITRE ATT&CK techniques, with notable patterns such as masquerading, PowerShell execution policy bypass, and secondary/fallback C2 logic to maintain connectivity if primary channels fail.

Mitigation

Apply strict governance for shortcut (LNK) execution, particularly from user-writable locations and compressed archives, and enforce hardened PowerShell execution policies with centralized logging. Restrict or proxy outbound access to unauthorized GitHub repositories, and alert on suspicious download-and-execute patterns originating from script interpreters. Monitor for persistence via Run registry keys or scheduled tasks with anomalous or newly observed names. Where feasible, deploy detections that surface common anti-analysis behaviors and ensure users handling PDFs operate under least privilege to reduce the blast radius of successful execution.

Response

Trigger alerts when the weaponized LNK is created or executed, and when the associated PowerShell invocation chain is observed. Proactively hunt for the dropped msedge_proxy.exe artifact and any linked persistence entries in the registry or task scheduler. Isolate affected endpoints, terminate the malicious process tree, and remove any created scheduled tasks and Run-key values. Complete a full forensic review to validate scope, confirm whether data was staged or exfiltrated, and identify any additional hosts exposed to the same ZIP/LNK delivery pattern.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands:

  1. Initial Compromise: The attacker sends a spear‑phishing email with a weaponized .lnk shortcut targeting a judicial employee. The shortcut points to a PowerShell command that runs with -ExecutionPolicy Bypass and a hidden window to avoid suspicion.

  2. Execution Flow: When the user clicks the shortcut, Windows runs the following command, which launches health‑check.bat. The batch file contains the real malicious payload (e.g., a PowerShell downloader that fetches a RAT).

      powershell.exe -ep bypass -w hidden -f health-check.bat

  3. Payload Delivery: health-check.bat performs a quiet HTTP GET to a malicious C2, writes the payload to %TEMP%, and executes it.

• Regression Test Script: The script below reproduces the exact telemetry by creating health‑check.bat with harmless content (to keep the test safe) and then invoking the PowerShell command.

  # -------------------------------------------------
  # Simulation Script – Weaponized LNK PowerShell Exec
  # -------------------------------------------------
  # 1. Create a dummy health-check.bat (harmless for testing)
  $batPath = "$env:TEMPhealth-check.bat"
  Set-Content -Path $batPath -Value '@echo off & echo Simulated payload executed' -Encoding ASCII
  
  # 2. Execute PowerShell with the exact flags and script name
  $psCommand = "powershell.exe -ep bypass -w hidden -f `"$batPath`""
  Write-Host "Executing: $psCommand"
  Start-Process -FilePath "powershell.exe" -ArgumentList "-ep", "bypass", "-w", "hidden", "-f", $batPath -NoNewWindow
  
  # 3. Wait a few seconds to ensure logs are generated
  Start-Sleep -Seconds 5
  # -------------------------------------------------

• Cleanup Commands: Remove the test batch file and any lingering processes.

  # Cleanup the dummy health-check.bat
  Remove-Item -Path "$env:TEMPhealth-check.bat" -ErrorAction SilentlyContinue
  
  # Ensure no stray PowerShell instances from the test remain
  Get-Process -Name "powershell" -ErrorAction SilentlyContinue | Stop-Process -Force