Netskope Threat Labs

SSHDropper

AV

This generic detection identifies malicious Windows shortcut (LNK) files that drop and execute SSH-based payloads for lateral movement.

First seen
August 2024
Last seen
September 2026
Alert Name
Dump:Generic.LNK.SSHDropper.A.FFFFFFFE
Generic.LNK.SSHDropper.A.00484AD3
Generic.LNK.SSHDropper.A.007844A8
Generic.LNK.SSHDropper.A.010E815C
Generic.LNK.SSHDropper.A.0131364F
Generic.LNK.SSHDropper.A.01569F6D
Generic.LNK.SSHDropper.A.017052CE
Generic.LNK.SSHDropper.A.019DAA33
Generic.LNK.SSHDropper.A.01B5F508
Generic.LNK.SSHDropper.A.02B263BF