At the centre of the campaign was the use of weaponised LNK files, a Windows shortcut format that can execute commands when opened. While LNK abuse has appeared in past intrusions, analysts noted a higher level of sophistication in this operation.
Microsoft has silently "mitigated" a high-severity WindowsLNK vulnerability exploited by multiple state-backed and cybercrime hacking groups in zero-day attacks ...Windows ShellLink (.lnk) files.