FlagThis

Multiple state-backed hacking groups, including those from North Korea, Iran, Russia, and China, have been exploiting a Windows zero-day vulnerability since 2017 for data theft and cyber espionage. The vulnerability lies in malicious .LNK shortcut files rigged with commands to download malware, effectively hiding malicious payloads from users. Security researchers at Trend Micro's Zero Day Initiative discovered nearly 1,000 tampered .LNK files, though they believe the actual number of attacks could be much higher.

Microsoft has chosen not to address this vulnerability with a security update, classifying it as a low priority issue not meeting their bar for servicing. This decision comes despite the fact that the exploitation avenue has been used in an eight-year-long spying campaign, relying on hiding commands using megabytes of whitespace to bury the actual commands deep out of sight in the user interface. Dustin Childs of the Zero Day Initiative told *The Register* that while this is one of many bugs used by attackers, its unpatched status makes it a significant concern.

ImgSrc: mnwa9ap4czgf-u1

References :

• CyberInsider: Microsoft has acknowledged that its latest Windows update has unintentionally uninstalled the Copilot app from some Windows 11 devices.
• The Register - Security: Microsoft isn't fixing 8-year-old shortcut exploit abused for spying
• BleepingComputer: At least 11 state-backed hacking groups from North Korea, Iran, Russia, and China have been exploiting a new Windows vulnerability in data theft and cyber espionage zero-day attacks since 2017.
• ZDI: Published Advisories: ZDI-25-148: (0Day) Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability
• securityonline.info: Hidden Threat: Zero-Day Windows Shortcut Exploited by Global APT Networks
• www.it-daily.net: Critical Windows security vulnerability discovered
• hackread.com: 11 Nation-State Hackers Exploit Unpatched Windows Flaw Since 2017
• socradar.io: Windows Shortcut Zero-Day (ZDI-CAN-25373) Exploited by State-Backed Threat Actors Since 2017: Overview of Key Details
• Tech Monitor: Windows shortcut exploit used as zero-day in global cyber espionage campaigns
• Security Risk Advisors: 🚩APT Groups Exploit Unpatched Windows Shortcut Vulnerability for Espionage and Data Theft
• Blog: Microsoft reluctant to patch Windows zero-day exploited by nation-state hackers
• www.cybersecuritydive.com: A vulnerability that allows for malicious payloads to be delivered via Windows shortcut files has not yet been addressed by Microsoft and has been under active attack for eight years.
• www.ghacks.net: Windows has an 8-year-old security issue that is exploited and known by Microsoft for some time
• Sam Bent: Microsoft Windows Zero-Day Used by Nation-States
• Jon Greig: Researchers Trend Micro's Zero Day Initiative said they have identified multiple campaigns from nation-state groups in North Korea, China and Russia exploiting an issue impacting .lnk files Microsoft said the report "does not meet the bar for immediate servicing"
• Threats | CyberScoop: Trend Micro researchers discovered and reported the eight-year-old defect to Microsoft six months ago. The company hasn’t made any commitments to patch or remediate the issue.
• Jon Greig: Researchers Trend Micro's Zero Day Initiative said they have identified multiple campaigns from nation-state groups in North Korea, China and Russia exploiting an issue impacting .lnk files Microsoft said the report "does not meet the bar for immediate servicing"
• www.trendmicro.com: Trend Zero Day Initiativeâ„¢ (ZDI) uncovered both state-sponsored and cybercriminal groups extensively exploiting ZDI-CAN-25373, a Windows .lnk file vulnerability that enables hidden command execution.
• Logpoint: Windows Shell Link Vulnerability ZDI-CAN-25373: Detecting Hidden Commands
• SecureWorld News: Nation-State Hackers Exploit Windows Shortcut Zero-Day Vulnerability
• : Windows Shortcut Flaw Exploited by 11 State-Sponsored Groups
• aboutdfir.com: Microsoft isn’t fixing 8-year-old shortcut exploit abused for spying An exploitation avenue found by Trend Micro in Windows has been used in an eight-year-long spying campaign, but there’s no sign of a fix from Microsoft, which apparently considers this a low priority.
• borncity.com: Windows shortcut exploit used by state hackers as a 0-day since 2017
• Information Security Buzz: Windows Shortcut Zero-Day Under Active Attack

Classification:

• HashTags: #WindowsZeroDay #CyberEspionage #StateSponsoredHacking
• Company: Microsoft
• Attacker: State-sponsored threat actors (China, Iran, North Korea, Russia)
• Product: Windows
• Type: 0Day
• Severity: Major