WebDAV-as-a-Service: The Infrastructure Behind Emmenhtal

Since December 2023 Sekoia's TDR team tracked an infrastructure distributing the memory-only Emmenhtal/PeakLight loader using WebDAV-hosted .lnk files and mshta.exe to fetch payloads; the infrastructure delivered many commodity infostealers and RATs (SelfAU3, DarkGate, Amadey, Redline, etc.), hosted across >100 WebDAV servers and several repeated AS providers, and likely operates as an Infrastructure-as-a-Service for multiple cybercriminal clients, posing an ongoing stealthy malware distribution threat.