APT36 (Transparent Tribe) ran a spear-phishing campaign that delivered a malicious LNK shortcut masquerading as a PDF. When opened, the shortcut launches mshta.exe to execute an HTA-based loader that decrypts and runs payloads in memory, including a configuration module and a full-featured RAT DLL. The malware dynamically selects persistence methods based on the victim’s installed antivirus product and connects to its command-and-control server over an encrypted channel. The activity is assessed as espionage-focused, targeting Indian government and academic organizations to steal data.
Researchers analyzed the unusually large LNK file, traced the embedded HTA content hosted on innlive.in , and reverse engineered the decryption logic. The chain revealed two primary stages: a .NET deserialization payload used to weaken or bypass security checks, followed by a fileless malicious DLL (e.g., ki2mtmkl.dll / iinneldc.dll ) providing RAT functionality. Persistence behavior was mapped to specific antivirus products, and key C2 details—such as TCP port 8621 and an AES key used for encrypted traffic—were extracted during analysis.
Restrict or quarantine shortcut ( .lnk ) attachments delivered via email, particularly when packed in ZIP archives. Apply application-control policies to limit execution of mshta.exe , PowerShell, and other scripting engines from user-writable paths. Use endpoint detections for process chains involving mshta.exe and indicators of in-memory DLL execution, and enforce tight egress controls to block communication with unknown or untrusted domains.
If suspicious LNK execution is detected, isolate the system, capture memory images, and hunt for in-memory DLL indicators tied to the RAT stage. Block identified malicious domains and related IP infrastructure, and rotate potentially exposed credentials. Perform forensic review to locate persistence artifacts in the Startup folder and registry, remove them, and validate that no additional footholds remain.
Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.
Attack Narrative & Commands: An adversary has gained low‑privilege PowerShell access on a compromised workstation. To execute a remote payload without writing an executable to disk, the attacker uses mshta.exe to run an HTA file that pulls a PowerShell back‑door from a C2 server. The steps are:
This chain creates a process‑creation event where mshta.exe is the child of powershell.exe , precisely matching the Sigma rule.
Regression Test Script:
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
