Investigating the New Jellyfish Loader

CRIL identified a new .NET-based shellcode loader dubbed "Jellyfish Loader" delivered via a malicious .lnk that triggers mshta to execute obfuscated JavaScript which downloads a lure PDF and the BinSvc.exe loader; the loader collects system information, base64-encodes it, validates/pins SSL certificates, communicates via HTTPS to ping.connectivity-check.com, and contains routines to receive and execute shellcode. The report includes technical analysis, file hashes, a YARA rule, domain/PDNS analysis linking the C2 domain to prior malicious PowerShell activity, and mitigation recommendations, while noting attribution remains unconfirmed.