.LNK (CVE-2010-2568) / Stuxnet Incident

Executive summary: A SaaS vendor's web-log forensic analysis detected a small number of machines infected with Stuxnet exploiting the .LNK vulnerability (CVE-2010-2568). Observed indicators include C2 domain mypremierfutbol.com (78.111.169.146), URL pattern index.php?data=66a96e28, consistent 24,778 byte responses, and MD5s for Stuxnet and related artifacts; the report recommends blocking known C2s, deploying AV signatures, filtering LNK files, and applying Microsoft's workaround and local mitigations.