# Screensaver (.SCR) Files Used as Initial Access Vector

> Screensaver (.SCR) files as initial access vector — Windows PE executables disguised with document/image icons, exploiting hidden extension defaults and email gateway filter gaps to achieve phishing-based code execution across APT and cybercrime campaigns since at least 2014.

- **Published:** 2026-02-16T10:36:50Z
- **Last reviewed:** 2026-02-16T10:36:50Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0104
- **ID:** TL-2026-0104
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Actor:** Cobalt Group
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Windows Screensaver (.SCR) files are fully functional Portable Executable (PE) binaries that Windows treats identically to .exe files — they execute directly when double-clicked. The .scr extension is a legacy artifact of Windows screensaver functionality, but the OS makes no distinction between .scr and .exe at the execution layer. This creates a powerful initial access vector: .scr files bypass email gateway filters that block .exe but allow .scr through allowlists or oversight, Windows hides the .scr extension by default (same 'Hide extensions for known file types' behavior as .exe), and attackers use double-extension tricks (e.g., 'invoice.pdf.scr') to make malicious executables appear as documents or images.

The technique has been documented across multiple threat actor categories:

1. **Cobalt Group (Carbanak)** — Confirmed by MITRE ATT&CK (T1566.001) and PT Security (2017). Cobalt Group sent spearphishing emails with password-protected archives containing .exe and .scr executables targeting financial institutions globally. This is the highest-confidence documented use of .scr in APT spearphishing.

2. **APT29/Cozy Bear/Midnight Blizzard** — The Dukes have employed PE-based executables with icon manipulation and hidden extensions in phishing campaigns targeting diplomatic organizations. ESET documented Operation Ghost (2013-2019) using sophisticated multi-stage delivery with PE payloads. APT29's recent campaigns (2022+, documented by Mandiant/Google) use ISO/IMG containers with LNK files pointing to malicious DLLs — the evolution beyond standalone .scr to container-based delivery that bypasses MotW.

3. **Kimsuky (North Korea)** — AhnLab ASEC documented Kimsuky's evolution from HWP documents to LNK-based delivery via archives. Kimsuky uses spearphishing with compressed files containing malicious executables (including .scr-class PE files) disguised as legitimate documents, primarily targeting South Korean government and defense sectors.

4. **Gamaredon/Armageddon (Russia/FSB)** — CERT-UA documented Gamaredon using HTM, HTA, and LNK files disguised as Word/Excel documents, along with USB propagation. Their rapid attack model (data exfiltration within 30-50 minutes) leverages disguised executables.

5. **General cybercrime** — MITRE ATT&CK T1036.007 (Double File Extension) explicitly lists .scr alongside .exe, .lnk, and .hta as dangerous extensions used in double-extension masquerading. SOCPrime documented detection rules for double-extension abuse in spearphishing.

The .scr vector persists because:
- Windows default settings hide file extensions, making 'document.pdf.scr' display as 'document.pdf'
- .scr files execute with full PE privileges — identical to .exe
- Some email gateways and web filters still don't block .scr in their executable extension lists
- Archives (ZIP/RAR/7z) strip MotW from contained files on many configurations
- The .scr extension has low awareness among end users compared to .exe
- Modern evolution: ISO/IMG containers further bypass MotW (APT29 technique, documented by Mandiant 2022)

Mark of the Web (MotW) behavior: .scr files downloaded directly from the internet receive MotW Zone.Identifier ADS, triggering SmartScreen prompts on Windows 10+. However, when delivered inside ZIP archives (and especially ISO/IMG containers), MotW propagation is inconsistent — Windows propagates MotW into ZIP contents since Win10 but ISO/IMG mounted files do NOT carry MotW (documented by Didier Stevens 2017, confirmed by Mandiant APT29 research). This gap is what drove the evolution from .scr-in-ZIP to .scr-in-ISO delivery.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1036.007 Double File Extension
- T1036.005 Match Legitimate Resource Name or Location
- T1036.002 Right-to-Left Override
- T1027 Obfuscated Files or Information
- T1553.005 Mark-of-the-Web Bypass
- T1546.002 Screensaver
- T1547.001 Registry Run Keys / Startup Folder
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1218.011 Rundll32
- T1218.005 Mshta
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1112 Modify Registry
- T1005 Data from Local System
- T1041 Exfiltration Over C2 Channel
- T1566.002 Spearphishing Link
- T1140 Deobfuscate/Decode Files or Information
- T1070.004 File Deletion
- T1569.002 Service Execution
- T1113 Screen Capture
- T1056.001 Keylogging

## Sources

- [MITRE ATT&CK T1036.007 — Masquerading: Double File Extension](https://attack.mitre.org/techniques/T1036/007/)
- [MITRE ATT&CK T1566.001 — Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
- [MITRE ATT&CK T1204.002 — User Execution: Malicious File](https://attack.mitre.org/techniques/T1204/002/)
- [MITRE ATT&CK T1546.002 — Event Triggered Execution: Screensaver](https://attack.mitre.org/techniques/T1546/002/)
- [PT Security — Cobalt 2017: Attacks on Financial Institutions (.scr in archives)](https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-2017-eng.pdf)
- [ESET — Operation Ghost: The Dukes (APT29) Never Left](https://www.welivesecurity.com/2019/10/17/operation-ghost-dukes-never-left/)
- [Mandiant/Google — Tracking APT29 Phishing Campaigns (ISO delivery evolution)](https://cloud.google.com/blog/topics/threat-intelligence/tracking-apt29-phishing-campaigns/)
- [AhnLab ASEC — Kimsuky Group Uses AutoIt to Create Malware](https://asec.ahnlab.com/en/59590/)
- [CERT-UA — Gamaredon Attack Traits and Rapid Data Exfiltration](https://cert.gov.ua/article/5160737)
- [DFIR Report — Cobalt Strike and SOCKS Lead to LockBit (PE masquerading)](https://thedfirreport.com/2025/01/27/cobalt-strike-and-a-pair-of-socks-lead-to-lockbit-ransomware/)
- [SOCPrime — Possible Malicious File Double Extension Detection](https://socprime.com/blog/rule-of-the-week-possible-malicious-file-double-extension/)
- [F-Secure — The Dukes: 7 Years of Russian Cyberespionage](https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0104