Install agent persistence via .LNK file

/static/assets/windows-logo.svg
APT40 is known to use .LNK files in the Windows StartUp folder for persistence. This procedure generates a link file using VBA and executes it. On startup, the link will execute a Pneuma agent.
locked
View Command

To view this TTPs command, you must be logged in with a professional or enterprise license.

Login

Test this TTP

Download Operator (1.7.0)
Test this TTP using one of our Operator chains
APT40 maritime industry

2022-04-19

/static/assets/windows-logo.svg
Emulating APT40's malware persistence techniques.