Mocky LNK

aliases

Last seen:Mar 17, 2026

Intelligence Profile

LNK files used to lure and orchestrate execution of various scripts, interacting with the Mocky API service.

Threat Analysis

Mocky LNK is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://cert.gov.ua/article/4492467

→https://go.recordedfuture.com/hubfs/reports/CTA-RU-2024-0530.pdf

→https://www.cert.ssi.gouv.fr/uploads/CERTFR-2023-CTI-009.pdf

→https://www.cert.ssi.gouv.fr/uploads/CERTFR-2025-CTI-007.pdf

→https://www.recordedfuture.com/research/grus-bluedelta-targets-key-networks-in-europe-with-multi-phase-espionage-camp

Quick Facts

TypeAPT / Threat Group

Aliases2

Also Known As

Mocky LNKwin.mocky_lnk

External Intelligence

Malpedia: win.mocky_lnk

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Mocky LNK