Threat Actor Targets Manufacturing Industry With Malware

CRIL reports a targeted multi-stage malware campaign against the manufacturing sector that begins with a malicious LNK file hosted on a WebDAV server and abuses ssh.exe, mshta.exe, PowerShell, and DLL sideloading/IDATLoader to deploy Lumma stealer and the Amadey bot; the analysis provides technical TTPs, file/URL/hash IOCs, and mitigation recommendations.