DeepLoad Malware USB Propagation - Disguised LNK Creation

Kaung Khant Ko@kaungkhantko

•updated Mar 31, 2026•5•0•100

Detects the creation of specific disguised shortcut (.lnk) files on drives, indicative of DeepLoad's USB propagation mechanism. DeepLoad spreads to adjacent endpoints by dropping over 40 disguised .lnk files onto connected USB drives.