Exploiting Microsoft CMSTP With Malicious LNK Files

This report analyzes a multi-stage campaign that begins with malicious .zip/.iso attachments containing LNK files which fetch obfuscated HTA/VBScript and PowerShell loaders; the chain uses AES-encrypted payloads and abuses cmstp.exe with a crafted INF to bypass UAC and execute payloads (RedLine, Blank Grabber, NetSupport RAT). The analysis includes decoding techniques, process and network behavior, numerous IOCs (URLs and hashes), a YARA rule, and recommendations to block suspicious CMSTP command lines and harden email filtering.