CRIL Investigates: LNK Files, SSH Commands, and the Evolution of Cyberattack Techniques

**Executive Summary:** CRIL research highlights a 2024 trend of threat actors abusing malicious LNK shortcut files combined with SSH/SCP and living‑off‑the‑land binaries to stealthily download and execute malicious payloads (via PowerShell, cmd.exe, rundll32, mshta), enabling persistence and data‑stealing activity; the report links similar techniques to APT groups (e.g., Transparent Tribe) and recommends restricting OpenSSH, monitoring SSH/SCP activity, and enhancing EDR detection.