CountLoader USB-worming: dropped .lnk on removable media referencing mshta.exe launch

Duo Tech@duotech

•updated Aug 6, 2026•4•0•2

Detects creation of a .lnk file on a removable/non-system drive letter (D: through Z:) whose launching process command line references mshta.exe, consistent with CountLoader's USB-worming propagation technique observed in the DOUBLECUP LaaS campaigns.