Malicious LNK Files and PowerShell Deploy Dual Remote-Access Tools Against Indian Applicants

Researchers describe 'Operation ShadowRecruit', a multi-stage campaign targeting Indian government job applicants using a ZIP lure containing an LNK that executes a PowerShell script to install a legitimate RMM (ControlR) with attacker-controlled enrollment and then a .NET dropper that deploys a custom RAT; the malware includes extensive anti-analysis checks and researchers observed multiple C2 management panels and provided IOCs and mitigations.