TA397’s New Attack Chain Delivers WmRAT and MiyaRAT Malware for Espionage

The attack chain used alternate data streams in a RAR archive to deliver a shortcut (LNK) file that created a scheduled task on the target machine to pull down further payloads.