Curl.exe Downloading from Google Cloud Storage Initiated by LNK File

Ethan Andrews@eandrews

•updated Jun 8, 2026•4•0•7

Detects instances where curl.exe is used to download payloads from storage.googleapis.com, with the initiating process being a .lnk file. This behavior is characteristic of the PXDropper/10FXRAT LNK campaign.