Stealthy Cyber Attacks: LNK Files & SSH Commands Playbook

This CRIL report documents a trend where threat actors weaponize Windows .LNK shortcut files to run SSH commands that abuse LOLBins (scp, ProxyCommand->PowerShell/mshta, cmd->rundll32) to download and execute payloads, including stealer-like binaries; it includes three SHA-256 IoCs, a Sigma detection rule, and mitigation recommendations such as monitoring ssh.exe usage and disabling OpenSSH where unnecessary.