APT37 NarwhalRAT HWP decoy + LNK co-delivery in user directories

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•5

Detects a suspicious sequence of events attributed to APT37, where a HWP or HWPX decoy file is written to user-accessible staging directories (Downloads, Temp, Desktop, Public) followed by the execution of a .lnk file using cmd.exe or explorer.exe within 30 seconds on the same device.