VILE Ransomware PowerShell Decryptor LNK Shortcut Creation via WScript.Shell

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•0

Detects execution of PowerShell commands used by VILE ransomware to create shortcut (.lnk) files and icons on the victim's desktop, utilizing WScript.Shell via a non-interactive PowerShell session.