Threat Actors Weaponizes LNK File to Deploy MoonPeak Malware Attacking Windows Systems
A recent malware campaign has been identified, targeting Windows users through the use of deceptive LNK shortcut files to distribute MoonPeak, a remote access trojan. This malware shares characteristics with XenoRAT and is associated with North Korean…
A recent malware campaign has been identified, targeting Windows users through the use of deceptive LNK shortcut files to distribute MoonPeak, a remote access trojan. This malware shares characteristics with XenoRAT and is associated with North Korean threat actors.
The primary targets of this campaign are South Korean investors and cryptocurrency traders. The attack leverages weaponized files masquerading as legitimate PDF documents related to trading strategies. Upon opening the malicious LNK file, a sophisticated infection chain is triggered, deploying the malware while displaying a decoy PDF to conceal malicious activity.
First detected in January 2026, the LNK files involved in this campaign contain Korean filenames, suggesting investment-related content. These files embed an XOR-encoded PDF that appears normal upon interaction, thereby deceiving users.
A hidden PowerShell script executes silently in the background, initiating multiple payload delivery stages and establishing persistence on infected systems. Communication is maintained with remote servers controlled by the attackers.
This malware shares characteristics with XenoRAT and is associated with North Korean threat actors.
IIJ Security Diary analysts have conducted detailed analysis, uncovering the complete infection flow. The infrastructure behind the attack makes use of GitHub repositories for hosting malicious payloads, illustrating the tactic of using legitimate platforms to evade detection.
The MoonPeak infection process comprises three distinct stages:
Stage One: The LNK file scans for security tools and virtual environments. Detection of analysis tools leads to immediate termination to prevent further study. Stage Two: A PowerShell script creates random folders and files in a temporary directory, downloading additional scripts from remote servers. A scheduled task ensures automatic execution. Stage Three: A GZIP-compressed payload is retrieved from a GitHub repository, loaded directly into memory. MoonPeak is then deployed, obfuscated with ConfuserEx to resist decompilation, and connects to a command-and-control server.
Based on reporting by Cyber Security News.