German Entities Under Attack: Sliver Implant Delivered via Malicious LNK Files

A new cyberattack targeting German organizations has been discovered. The attackers are using advanced methods to break into systems and avoid being detected. The attack starts with an archive file that contains a fake LNK file, which is likely spread through spear-phishing emails, although the exact way it starts is unclear. Once opened, the attack uses techniques like DLL Sideloading, DLL Proxying, and deploying a tool called Sliver to gain access and stay hidden in the victim’s network.