ISO container → LNK → stage from CDN → C2

§ Context

Assumed environment: target endpoints allow ISO mounting via Explorer (default on Windows 10/11). Macros may be blocked by GPO; attacker uses ISO as the modern alternative.

§ Steps

1. 01
   Cobalt-class beacon establishes C2Command and Control

   T1071— Application Layer Protocol
2. 02
   Stager pulls payload from CDNCommand and Control

   T1071— Application Layer Protocol
3. 03
   Email with ISO attachmentInitial Access

   T1566— Phishing
4. 04
   Local persistencePersistence

   W-SCHEDTASK-HIJACK— Scheduled Task Hijack
5. 05
   Victim double-clicks → ISO mounts (no MOTW)Execution

   PAY-ISO-LNK— ISO / IMG Mounting → LNK Execution
6. 06
   LNK fires hidden cmd.exe / mshtaExecution

   PAY-HTA-VBS— HTA / VBS / WSF Execution

§ References

• T1071Application Layer Protocol
• T1566Phishing

§ Frequently asked

What is the "ISO container → LNK → stage from CDN → C2" attack path?

Email attaches an ISO. Windows mounts it as a drive, bypassing Mark-of-the-Web. LNK inside runs a hidden binary that pulls the real stager from a CDN — Defender often misses the chain. It chains 6 steps drawn from real-world offensive-security techniques.

What starting position does this attack require?

The first step is Cobalt-class beacon establishes C2 (T1071) — a command and control primitive. Assumed environment: target endpoints allow ISO mounting via Explorer (default on Windows 10/11).

What is the final impact of this kill-chain?

The final step lands on LNK fires hidden cmd.exe / mshta (PAY-HTA-VBS), which falls under Execution. From here, an operator typically pivots into post-exploitation or maintains persistence.

How can defenders detect or prevent this attack?

Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers

• Shared techniques3

  OneNote .one attachment → embedded payload → C2

  OneNote .one file with a friendly 'Double-click to view' overlay hides an embedded HTA / VBS / EXE. Effective initial access vector after Microsoft blocked internet macros in 2022.

• Shared techniques2

  certutil + bitsadmin → AV-friendly stager chain

  Initial access dropped a tiny .bat. It uses certutil to decode a base64 blob and bitsadmin to fetch the real beacon, then schtasks for persistence. Every binary is signed Microsoft.

• Shared techniques2

  USB drop in parking lot → HID payload → C2

  Drop branded-looking USB sticks near the target site. An employee plugs one in; a Rubber-Ducky-class HID device types a PowerShell payload that connects out to attacker C2.