A newly documented espionage campaign is using disguised shortcut files — not real PDFs — to infect people and organizations connected to Ukraine, according to new threat intelligence. The activity reportedly stretches back to early 2026 and shows the hallmarks of a patient, well-resourced intrusion operation rather than opportunistic crimeware.
What happened
The attack starts with a ZIP archive containing a Windows shortcut (.LNK) file dressed up to look like a PDF document. Lure themes observed so far include official-looking government correspondence and apparel-industry business documents — both crafted to look legitimate enough that a recipient opens the file without hesitation. In one case the attackers impersonated a South Korean hosting provider; in another, a Ukrainian clothing company.
Once opened, the shortcut silently launches PowerShell in the background to pull down the next stage, while a real decoy document displays on screen to mask the compromise from the victim.
The payload, tracked as VelvetCake, is a loader built for stealth and reuse. It fetches and runs shellcode directly in memory, cleans up after itself once its job is done, and can be reconfigured to check for security tools, adjust network settings, and drop a rotating set of follow-on capability — from credential harvesters and infostealers to reconnaissance utilities and remote-access tools. Analysts observed the loader periodically checking in with an attacker-controlled server for instructions, executing them, and sending results back out — including, in at least one case, an exfiltrated screenshot.
Why it matters
Researchers tie the campaign — its Ukraine-focused lures, shortcut-based delivery, and overlapping attacker infrastructure — to the Konni malware family, a toolset with a track record of targeting government, diplomatic and NGO staff working on Ukraine-related matters. The findings stop short of a firm conclusion, but the pattern is consistent with a targeted, intelligence-gathering operation rather than mass-market malware.
For organizations that handle Ukraine-related communications, diplomatic correspondence, or humanitarian coordination, this is a reminder that document-borne attacks remain a live and evolving channel for espionage — and that a file that "looks like a PDF" is not the same as a file that is a PDF.
What to do
- Verify file types before opening. Shortcut (.LNK) files can carry a PDF-style icon and filename — check the actual file extension and type, not just the display name, especially inside ZIP attachments.
- Restrict LNK execution from email and downloads where feasible, and log PowerShell command-line activity so downloader behavior stays visible.
- Watch for unexpected scheduled tasks — persistence via scheduled tasks was observed in this campaign and is a strong detection signal.
- Review network egress for connections to newly registered or low-reputation domains, particularly around the time a document attachment was opened.
- Brief staff who handle Ukraine-related or diplomatic correspondence specifically, since they appear to be the deliberate targets of these lures.
- Treat unsolicited document archives and meeting-themed attachments from unfamiliar senders with extra scrutiny, even when the subject matter looks routine.