APT29 Malicious LNK File Masquerading As Image

Tim Peck@timpeck

•updated Sep 17, 2025•0•102

Detects the execution of a Windows Shortcut File (.lnk) that is masquerading as an image file. This technique is used by threat actors like APT29 to trick users into executing malicious code, often delivered within an ISO or ZIP file.