Larva-24009 Lures Firms With Fake Doc Attachments

How the attack worked

Larva-24009 sends phishing emails with attachments that look like ordinary documents but are actually shortcut (LNK) files. Filenames often include double extensions such as ".Docx.Lnk" along with version numbers or timestamps to appear routine. Once a recipient opens the file, it launches an obfuscated PowerShell command. To avoid raising suspicion, the malware drops a decoy document in the TEMP directory and opens it while simultaneously downloading additional PowerShell scripts in the background.

Those scripts install remote access tools including QuasarRAT and UltraVNC, and the actor may also rely on RDP for control. Persistence is maintained through scheduled tasks given legitimate-sounding names like Intel or GoogleUpdate, which helps the malware blend in with normal system activity. For data theft, the toolkit includes screenshot capture, keylogging, and NirSoft credential-recovery utilities, along with a notifier component that reports infection status, in some versions via the Telegram API.

Why it succeeded

The lures used business-relevant, low-friction topics: hospital surveys, blockchain project updates, project documentation, and resumes. These themes target common workflows across Human Resources, recruiting, project management, operations, and healthcare administration, where opening an attached document is routine and expected. Because the decoy document opens normally after the LNK file executes, the victim has little reason to suspect anything happened in the background.

What to watch for

• Attachments with double extensions ending in ".Lnk", such as ".Docx.Lnk", presented as Word documents.
• Unusually long filenames containing version numbers or timestamps.
• Unexpected requests to open an attachment rather than share a standard document or link.
• A document that opens normally but was preceded by an unusual attachment type.
• Business-themed pretexts, resumes, surveys, or project files, that push urgency to open an attachment.

How to build resistance

Organizations should train employees, especially in HR, recruiting, project management, operations, and healthcare administration, to treat any "document" that actually carries a shortcut extension as suspicious and report it rather than open it. Staff should be cautious with executable files from unknown sources generally, not only attachments labeled as documents. Keeping endpoint security software updated helps reduce the chance that a malicious attachment can execute successfully even if it is opened. Encouraging a habit of reporting anything unusual after opening an attachment, even if the visible document appears normal, can help catch infections that rely on a decoy file to avoid suspicion.

What is Larva-24009?

Larva-24009 is a threat actor that AhnLab ASEC has tracked using phishing emails with malicious LNK files disguised as document attachments to compromise organizations.

How does the fake document attachment infect a system?

When the LNK file is opened it runs an obfuscated PowerShell command, drops a decoy document in the TEMP folder to appear legitimate, and downloads additional malware in the background.

What kind of lures does Larva-24009 use?

The campaign has used business-themed topics such as hospital surveys, blockchain, project documentation, and resumes to make the attachments seem credible.

What malware gets installed after the attachment is opened?

Reported tools include QuasarRAT and UltraVNC for remote access, along with NirSoft credential-recovery utilities, screenshot capture, and keylogging, plus a notifier component that reports infection status.