LNK and PowerShell Delivery Chains

The malware asks a question and reads its orders off the doormat: PowerShell in FTP banners

SOCRadar says LNK files are pulling PowerShell out of FTP pre-login greetings to stage two RATs. The retrieval finishes before any login, so there is nothing for a transfer log to record.