VenomLNKMalware
VenomLNK is the initial phase of the more_eggs malware-as-a-service. It is a poisoned.lnk file that depends on User Execution and points to LOLBINs (often cmd.exe) with additional obfuscated scripting options. This typically initiates WMI abuse and TerraLoader, which can load additional functionality through various plugins.From MISP Galaxy
Last reported 3 months ago, by Recorded Future1 report
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
TAG-195 Upgrades MaaS Ecosystem with Modular Tools“Additionally, Insikt Group tracks TAG-127 as a threat group that uses the TAG-195 MaaS, with ClickFix or VenomLNK as delivery methods.”
Thanks — we review every report.