TA397 utilizes a malicious shortcut (LNK) file embedded within a RAR archive. This LNK file, when activated, executes PowerShell code that creates a scheduled task on the victim’s machine. This scheduled task enables the download and execution of additional payloads, establishing persistence on the compromised system.
Tag: TA397
Hunting all around for TA397 RATs
Attackers are using phishing emails to deliver malicious attachments that gather system information and exfiltrate it to a remote server.