ENKI analyzes RokRAT activity that uses malicious LNK files as an initial execution mechanism, a technique increasingly observed after Microsoft restricted Office macros and began phasing out VBScript. The source says attackers commonly deliver archives containing an embedded-command LNK file, sometimes alongside benign documents, and then use the shortcut to run commands through PowerShell. The report is relevant to RokRAT detection, LNK command extraction, and email-borne initial access triage.