REMCOS Variant Leverages LNK Files to Bypass AV Engines, Enhancing Threat Actor Capabilities

A recent cybersecurity investigation has uncovered a sophisticated, multi-stage malware campaign utilizing malicious Windows shortcut (LNK) files to stealthily deploy the notorious REMCOS backdoor.

The attack demonstrates a notable evolution in threat actor tactics, as it leverages legitimate operating system tools and system behaviors to evade traditional antivirus (AV) defenses.

By exploiting the inherent trust and functionality of Windows LNK files typically used to launch programs or access documents attackers are able to bypass heightened security controls and deliver persistent, fileless malware payloads directly to target endpoints.

Technical Infection Chain

The attack is initiated via social engineering, with targeted phishing emails distributing weaponized shortcut files masquerading as benign documents or purchase orders.

LNK files are camouflaged with deceiving names and icons such as “Invoice.pdf.lnk” or “ORDINE-DI-ACQUIST-7263535,” preying on the default behavior of Windows to hide known file extensions and obfuscate their true nature.

According to the researchers, upon execution, the LNK file does not display a warning as macro-based Office documents would.

Instead, embedded within its “Target” field is a concealed PowerShell command, exploiting the deep command-line argument support of the shortcut format.

The observed payload chain begins with PowerShell silently downloading a Base64-encoded file from a remote server specifically “shipping-hr.ro” and writing it to the hidden ProgramData directory as “HEW.GIF.”

Contrary to its extension, this file is not an image but rather a disguised, encoded payload. The next stage involves reading “HEW.GIF,” decoding it from Base64, and writing the resulting binary to disk as “CHROME.PIF.”

The PowerShell script then proceeds to launch the PIF file, which acts as an executable MS-DOS program.

This staged, memory-resident approach allows the malware to avoid dropping clearly malicious files to disk until the very last moment, circumventing signature-based AV controls.

Further analysis of the CHROME.PIF payload reveals a packed Portable Executable embedding the REMCOS backdoor. Once launched, REMCOS initializes advanced persistence and surveillance mechanisms.

It leverages key Windows APIs such as user32.dll’s SetWindowsHookExA to institute a functional keylogger, writes captured keystrokes to logs in a dedicated “remcos” folder within ProgramData, and establishes communication with remote command and control servers (including addresses in Romania and the United States).

Network monitoring revealed encrypted C2 traffic to IPs “92.82.184.33” and “198.23.251.10,” with DNS resolution confirming the use of “shipping-hr.ro” for initial payload delivery.

Persistence is maintained via additional dropped components and registry modifications, while lateral movement and further payload execution are facilitated by secondary droppers and scheduled tasks.

Threat Assessment

Security tools flagged the primary LNK and PIF artifacts as Trojan.WinLNK.Powershell_S03. However, the fileless technique’s reliance on trusted system utilities such as PowerShell complicates reliable detection.

Attackers benefit from the lack of explicit warnings on shortcut execution and exploit user trust in familiar iconography.

The inclusion of Base64-encoded intermediaries frustrates static analysis, while the final binary backdoor delivers the full suite of REMCOS control features keystroke logging, webcam and microphone capture, file exfiltration, and execution of arbitrary commands.

Given the evolving landscape of fileless and living-off-the-land attacks, organizations are urged to enforce strict attachment controls, educate users on the subtleties of LNK files, enable real-time monitoring of PowerShell activity, and implement robust endpoint protection.

Manual remediation includes searching for suspicious files in ProgramData, deleting unauthorized shortcuts, and auditing run and startup entries.

As LNK-based malware campaigns continue to mature, the findings underscore the need for integrated security controls and ongoing user vigilance to thwart increasingly seamless threat actor operations.

Indicators of Compromise (IOC)

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates