Figure 3: FIN7 phishing lure persistence mechanisms Examining Attacker Shortcut Files In many cases, attacker-created LNK files can reveal valuable information about the attacker’s development environment