Patchwork group macro-to-.LNK DLL side-loading sequence
Malware Activity
Summary
Hide ▲
Show ▼
A Patchwork group infection sequence now uses a malicious macro, .LNK file, PowerShell, and DLL side-loading to launch a payload that can exfiltrate data and collect system information.
Related Happenings
LeakNet ransomware gang ClickFix and Deno in-memory loader activity
Malware Activity
H score23
First: 17.03.2026 14:09
Last: 17.03.2026 14:09
Sources 1
About this happening:
The LeakNet ransomware gang has adopted ClickFix initial access and a Deno-based loader that executes malicious code in memory, making intrusions harder to detect and...
LeakNet ransomware gang ClickFix and Deno in-memory loader activity
Malware ActivityAbout this happening: The LeakNet ransomware gang has adopted ClickFix initial access and a Deno-based loader that executes malicious code in memory, making intrusions harder to detect and...
SPLITDROP, TWINTASK, TWINTALK, and GHOSTFORM multi-stage malware deployment
Malware Activity
H score18
First: 05.03.2026 14:01
Last: 05.03.2026 14:01
Sources 1
About this happening:
A Windows malware set composed of SPLITDROP, TWINTASK, TWINTALK, and GHOSTFORM was deployed across two infection chains, expanding the operation’s command,...
SPLITDROP, TWINTASK, TWINTALK, and GHOSTFORM multi-stage malware deployment
Malware ActivityAbout this happening: A Windows malware set composed of SPLITDROP, TWINTASK, TWINTALK, and GHOSTFORM was deployed across two infection chains, expanding the operation’s command,...
OAuth-phished ZIP/LNK/PowerShell malware delivery chain
Malware Activity
H score19
First: 03.03.2026 11:20
Last: 03.03.2026 11:20
Sources 1
About this happening:
ZIP-delivered malware now uses a PowerShell and DLL side-loading chain to infect Windows devices and reach an external C2 server, increasing the risk of follow-on...
OAuth-phished ZIP/LNK/PowerShell malware delivery chain
Malware ActivityAbout this happening: ZIP-delivered malware now uses a PowerShell and DLL side-loading chain to infect Windows devices and reach an external C2 server, increasing the risk of follow-on...
Lnk-it-up open-source suite for generating and detecting malicious Windows LNK shortcuts
Security Tool/Service
H score14
First: 12.02.2026 23:01
Last: 12.02.2026 23:01
Sources 1
About this happening:
lnk-it-up is a newly released open-source suite for Windows LNK shortcuts that helps testers generate deceptive files and helps defenders spot shortcuts where Explorer...
Lnk-it-up open-source suite for generating and detecting malicious Windows LNK shortcuts
Security Tool/ServiceAbout this happening: lnk-it-up is a newly released open-source suite for Windows LNK shortcuts that helps testers generate deceptive files and helps defenders spot shortcuts where Explorer...
Microsoft silently patches in Windows LNK files remote code execution flaw (CVE-2025-9491)
Vulnerability
H score32
First: 12.02.2026 23:01
Last: 12.02.2026 23:01
Sources 1
About this happening:
Windows LNK shortcut files remain the focus of this vulnerability thread: CVE-2025-9491 / ZDI-CAN-25373 is being used in September-October 2025 spear-phishing atta...
Microsoft silently patches in Windows LNK files remote code execution flaw (CVE-2025-9491)
VulnerabilityAbout this happening: Windows LNK shortcut files remain the focus of this vulnerability thread: CVE-2025-9491 / ZDI-CAN-25373 is being used in September-October 2025 spear-phishing atta...
Timeline
-
02.10.2025 17:44 2 articles · 9mo ago
Patchwork macro-to-.LNK DLL side-loading infection chain
Technical Analysis UpdatePatchwork group infection sequence begins with a malicious macro that downloads a .LNK file, where embedded PowerShell code fetches additional payloads and uses DLL side-loading to launch the primary malware while a decoy PDF is displayed. The payload contacts a C2 server, gathers system information, decrypts an encoded instruction for cmd.exe, takes screenshots, uploads files, downloads files from a remote URL into a temporary directory, and retries data transmission up to 20 times.
Show sources
- Confucius Hackers Hit Pakistan With New WooperStealer and Anondoor Malware — thehackernews.com — 02.10.2025 17:44
- Confucius Hackers Hit Pakistan With New WooperStealer and Anondoor Malware — thehackernews.com — 02.10.2025 17:44