Back 
Netskope Threat Research Labs has become aware of an ongoing data theft attack. The attack begins as an email attachment and results in the installation of banking and credential theft malware, including Ursnif. Though the attachments used in the campaign were once malicious Office documents, they have recently been updated to use attachments more difficult for traditional security products to process. In either case, many of the attachments will then download the payload malware from SaaS applications.
The current attack chain employs .lnk files and PowerShell to install its payload. As a result, several difficulties exist in traditional static scan, or runtime/sandbox evaluation of this threat. Netskope Threat Research Labs recommends that Security Administrators use a threat-aware CASB with cloud app instance-level inspection to broadly prevent these threats.
This blog will provide an analysis of attacks using .lnk files powered with PowerShell and how these attacks can be prevented with app-level granularity by applying threat protection policies.
Analysis of the .LNK file
In the most recent versions of the attack, .lnk attachments are used in place of more common Office file attachments. These attachments, detected by Netskope Threat Protection as Backdoor.LNK.NX execute PowerShell which downloads final payloads from SaaS applications, such as Dropbox.
Many enterprise users employ features to automatically sync their attachments to the cloud, opening their collaborative network up to a CloudPhishing fanout effect. In these cases, the aforementioned detection is crucial to preventing subsequent attack spread.
Figure 1 shows one such localized attack being received by a .ch TLD (Top Level Domain).
Figure 1: Email with the malicious .lnk file
<