Return of the Higaisa APT

**Executive summary:** This report analyzes an LNK-based espionage campaign (May 2020) attributed to the Higaisa APT that uses malicious LNK files inside RAR attachments to drop a multi-stage backdoor (svchast.exe loader + shellcode) which employs anti-analysis, a complex cryptographic key-derivation routine, and a FakeTLS-style C2 channel created by duplicating socket handles; the report includes technical analysis, YARA hunting rules, MITRE ATT&CK mappings, and a set of IOCs (file hashes, URLs, C2 addresses) for detection and response.