This report is about a vulnerability called CVE-2020-0684 which affects multiple versions of the Microsoft Windows operating system. The vulnerability is due to mishandling of a specific file type where successful exploitation generally depends on social engineering. There are multiple patches available from Microsoft depending on the type of operating system in use.
The vulnerability is caused by the mishandling of specially crafted .LNK files which allows an attacker to package malicious code and gain user privileges. The user privileges being gained here are that of the currently running user which could have far-reaching implications depending on that specific user account’s permission levels.
Bad actors use three common tactics to package their malware in a variety of forms.
The software flaw opens users to social engineering. Other potential methods of distributing the malicious file could involve the following: putting the file on a removable drive or using a remote network share both of which require some work.
We strongly encourage implementing the vendor patch here.
IBM X-Force Exchange:
Belkasoft's Forensic Analysis of LNK Files
Note: The Avertium Threat Report analyzes one current threat that has been shared by threat intelligence networks across the globe. Used internally by the Avertium CyberOps Team, this report will outline a “top-of-mind” threat and how it ought to be addressed accordingly.
This informed analysis is based on the latest data available.
Contact us for more information about Avertium’s managed detection and response service capabilities.