FlagThis

A critical unpatched zero-day vulnerability in Microsoft Windows is being actively exploited by 11 state-sponsored threat groups for espionage, data theft, and financially motivated campaigns since 2017. The flaw, tracked as ZDI-CAN-25373, involves the use of crafted Windows Shortcut (.LNK) files to execute hidden malicious commands. This allows attackers to gain unauthorized access to systems, steal sensitive data, and potentially conduct cyber espionage activities targeting governments, private entities, financial organizations, think tanks, telecommunication service providers, and military/defense agencies across multiple countries.

The attacks leverage hidden command line arguments within the malicious .LNK files, making detection difficult by padding the arguments with whitespace characters. Nearly 1,000 .LNK file artifacts exploiting the vulnerability have been found, and linked to APT groups from China, Iran, North Korea, and Russia. In these attacks, the .LNK files act as a delivery vehicle for malware families like Lumma Stealer, GuLoader, and Remcos RAT. Microsoft considers the issue a low severity user interface misrepresentation and does not plan to release a fix.

ImgSrc: mnwa9ap4czgf-u1

References :

• The Hacker News: An unpatched security flaw impacting Microsoft Windows has been exploited by 11 state-sponsored groups from China, Iran, North Korea, and Russia as part of data theft, espionage, and financially motivated campaigns that date back to 2017.
• ZDI: Published Advisories: ZDI-25-148: (0Day) Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability
• The Register - Security: Microsoft isn't fixing 8-year-old shortcut exploit abused for spying
• securityaffairs.com: State-Sponsored Actors and Cybercrime Gangs Abuse Malicious .lnk Files for Espionage and Data Theft
• The DefendOps Diaries: Exploiting Windows Zero-Day Vulnerabilities: The Role of State-Sponsored Hacking Groups
• BleepingComputer: New Windows zero-day exploited by 11 state hacking groups since 2017
• CyberInsider: Microsoft Declines to Fix Actively Exploited Windows Zero-Day Vulnerability
• socradar.io: Windows Shortcut Zero-Day (ZDI-CAN-25373) Exploited by State-Backed Threat Actors Since 2017: Overview of Key Details
• Virus Bulletin: Trend Micro ZDI's Peter Girnus & Aliakbar Zahravi describe how researchers uncovered both state-sponsored and cybercriminal groups extensively exploiting ZDI-CAN-25373, a Windows .lnk file vulnerability that enables hidden command execution.
• Tech Monitor: A Windows shortcut vulnerability, identified as ZDI-CAN-25373, has been exploited in widespread cyber espionage campaigns.
• www.ghacks.net: Windows has an 8-year-old security issue that is exploited and known by Microsoft for some time
• www.cybersecuritydive.com: 11 nation-state groups exploit unpatched Microsoft zero-day
• www.techradar.com: An unpatched Windows zero-day flaw has been exploited by 11 nation-state attackers
• Security Risk Advisors: APT Groups Exploit Unpatched Windows Shortcut Vulnerability for Espionage and Data Theft
• hackread.com: 11 Nation-State Hackers Exploit Unpatched Windows Flaw Since 2017
• : Windows Shortcut Flaw Exploited by 11 State-Sponsored Groups
• securityonline.info: A recently uncovered vulnerability, ZDI-CAN-25373, identified by the Trend Zero Day Initiative (ZDI), is at the center of the
• Blog: Microsoft reluctant to patch Windows zero-day exploited by nation-state hackers
• Virus Bulletin: Trend Micro ZDI's Peter Girnus & Aliakbar Zahravi describe how researchers uncovered both state-sponsored and cybercriminal groups extensively exploiting ZDI-CAN-25373, a Windows .lnk file vulnerability that enables hidden command execution.
• Sam Bent: Windows Shortcut Zero-Day Used by Nation-States
• www.trendmicro.com: ZDI-CAN-25373: Windows Shortcut Exploit Abused as Zero-Day in Widespread APT Campaigns
• Logpoint: Windows Shell Link Vulnerability ZDI-CAN-25373: Detecting Hidden Commands
• SecureWorld News: Nation-State Hackers Exploit Windows Shortcut Zero-Day Vulnerability
• Information Security Buzz: Windows Shortcut Zero-Day Under Active Attack
• borncity.com: Windows shortcut exploit used by state hackers as a 0-day since 2017
• Threats | CyberScoop: Nation-state groups hit hundreds of organizations with Microsoft Windows zero-day
• Help Net Security: APTs have been using zero-day Windows shortcut exploit for eight years (ZDI-CAN-25373)
• aboutdfir.com: Microsoft isn’t fixing 8-year-old shortcut exploit abused for spying
• securityboulevard.com: Microsoft Won’t Fix This Bad Zero Day (Despite Wide Abuse)
• aboutdfir.com: Microsoft isn’t fixing 8-year-old shortcut exploit abused for spying An exploitation avenue found by Trend Micro in Windows has been used in an eight-year-long spying campaign, but there’s no sign of a fix from Microsoft, which apparently considers this a low priority.

Classification:

• HashTags: #APT #ZeroDay #Espionage
• Company: Microsoft
• Target: Various organizations
• Attacker: State-sponsored groups
• Product: Windows
• Feature: lnk file execution
• Malware: lnk
• Type: Espionage
• Severity: Major