Sliver Implant Attacking German Entities With Weaponized LNK Files

Cybersecurity experts at Cyble have uncovered a sophisticated ongoing cyberattack campaign that employs a series of deceptive tactics to compromise systems within organizations in Germany.

The attack involves a malicious archive file that, when extracted, executes harmful actions while masquerading as a legitimate document.

Deceptive Tactics Unveiled

The campaign was initiated through a spear-phishing email containing an archive file named “Homeoffice-Vereinbarung-2025.7z.”

Although the precise method of delivery remains unclear, the file is designed to trick recipients into executing a harmful LNK (shortcut) file hidden among other seemingly benign components, including legitimate executables and a decoy PDF document.

Upon extraction, the archive reveals a collection of files, including:

• A malicious DLL file (IPHLPAPI.dll)
• A legitimate DLL file (IPHLPLAPI.dll), poorly disguised under a slightly altered name
• An encrypted DAT file (ccache.dat) containing shellcode
• A decoy PDF claiming to be a “Home Office Agreement”

Most notably, the decoy document, recently created to enhance its relevance, aims to lure users into opening it, thereby triggering the malicious payload hidden within the archive.

Attack Mechanics

Once the LNK file is executed, it first opens the decoy PDF, creating the illusion of normalcy for the user.

Simultaneously, it activates a legitimate executable, wksprt.exe, which engages in DLL sideloading to covertly load the malicious DLL.

This process allows the attackers to execute their code without drawing attention from conventional security measures.

The malicious DLL is particularly insidious, as it acts as a proxy for the legitimate DLL, forwarding function calls while executing its own code.

This advanced technique enables the cybercriminals to maintain the application’s normal behavior while executing malicious operations.

Additionally, the encryption methods used to conceal the shellcode provide a further layer of obfuscation.

Once decrypted, the shellcode launches a Sliver implant, an open-source framework employed by attackers for command and control operations, establishing communications with remote servers to facilitate further malicious activities.

While the specific group behind this operation has not yet been definitively identified, the techniques employed particularly DLL sideloading and shellcode injection exhibit patterns reminiscent of past campaigns associated with APT29, a notorious group known for targeting organizations with advanced cyber tactics.

According to the Cyble report, this campaign highlights an alarming trend in the evolution of cyber threats, demonstrating an increased sophistication in tactics that bypass traditional security measures.

With the lure of a legitimate employee agreement for remote work, the attack is particularly relevant for organizations navigating the complexities of hybrid work arrangements.

To combat the threats posed by such cyberattacks, cybersecurity experts recommend that organizations adopt several proactive measures:

1. Implement Robust Email Filtering: Strengthening email security to identify and prevent harmful attachments from reaching users.
2. Exercise Caution with Attachments: Encouraging employees to verify the sender’s identity, particularly for unexpected or suspicious emails.
3. Utilize Application Whitelisting: Preventing unauthorized execution of LNK files and other suspicious components.
4. Deploy Endpoint Detection and Response Solutions: Identifying and blocking malicious behaviors like DLL sideloading and shellcode injection.
5. Monitor Network Activities: Keeping an eye on unexpected outbound connections to detect potential Sliver framework-related behaviors.

This cyberattack campaign serves as a stark reminder of the evolving landscape of cyber threats.

Organizations must remain vigilant and enhance their defensive strategies to protect against such sophisticated, multi-stage attacks that threaten to compromise their systems and sensitive data.

Also Read:

Richardson Sales Performance Hit by Qilin Ransomware

See more