Microsoft "mitigates" Windows LNK flaw exploited as zero-day
Recorded: Dec. 3, 2025, 9:02 p.m.
| Original | Summarized |
Microsoft "mitigates" Windows LNK flaw exploited as zero-day News Featured North Korea lures engineers to rent identities in fake IT worker scheme Shai-Hulud 2.0 NPM malware attack exposed up to 400,000 dev secrets Microsoft "mitigates" Windows LNK flaw exploited as zero-day University of Phoenix discloses data breach after Oracle hack Russia blocks FaceTime and Snapchat over use in terrorist attacks Create compliance docs with this $40 governance & cybersecurity bundle CISA warns of Chinese "BrickStorm" malware attacks on VMware servers Contractors with hacking records accused of wiping 96 govt databases Tutorials Latest How to access the Dark Web using the Tor Browser How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to use the Windows Registry Editor How to backup and restore the Windows Registry How to start Windows in Safe Mode How to remove a Trojan, Virus, Worm, or other Malware How to show hidden files in Windows 7 How to see hidden files in Windows Webinars Latest Qualys BrowserCheck STOPDecrypter AuroraDecrypter FilesLockerDecrypter AdwCleaner ComboFix RKill Junkware Removal Tool Deals Categories eLearning IT Certification Courses Gear + Gadgets Security VPNs Popular Best VPNs How to change IP address Access the dark web safely Best VPN for YouTube Forums Virus Removal Guides HomeNewsMicrosoftMicrosoft "mitigates" Windows LNK flaw exploited as zero-day Microsoft "mitigates" Windows LNK flaw exploited as zero-day By Sergiu Gatlan December 3, 2025 Microsoft has silently "mitigated" a high-severity Windows LNK vulnerability exploited by multiple state-backed and cybercrime hacking groups in zero-day attacks. Malicious arguments not showing in the Target field (Trend Micro) "Our patch would break the 1000+ malicious shortcuts identified by Trend Micro for all targeted users, while Microsoft's patch would only allow the most cautious among these users - who would probably not launch such shortcuts anyway - to see the entire malicious command string," Kolsek said. Break down IAM silos like Bitpanda, KnowBe4, and PathAI Related Articles: 0patch Sergiu Gatlan Previous Article Comments
RexvimilZuzakzmo - 19 hours ago Is it only me, or updating windows do seem to make it actually less secure these days? Post a Comment Community Rules You need to login in order to post a comment You may also like: Popular Stories ChatGPT is down worldwide, conversations disappeared for users Marquis data breach impacts over 74 US banks, credit unions Glassworm malware returns in third wave of malicious VS Code packages Sponsor Posts Overdue a password health-check? Audit your Active Directory for free Empowering IT teams with intelligence driven cyber threat research. AI is a data-breach time bomb: Read the new report Hackers love the holidays! Share FREE Security Awareness Training to keep family & friends cyber-safe! Follow us: Main Sections News Community Forums Useful Resources Welcome Guide Company About BleepingComputer Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2025 Bleeping Computer® LLC - All Rights Reserved Login Username Password Remember Me Sign in anonymously Sign in with Twitter Not a member yet? Register Now Help us understand the problem. What is going on with this comment? Spam Abusive or Harmful Inappropriate content Strong language Other Read our posting guidelinese to learn what content is prohibited. Submitting... |
Microsoft has implemented a temporary mitigation strategy for a critical Windows LNK vulnerability, designated CVE-2025-9491, which has been actively exploited by numerous state-sponsored and cybercrime groups since March 2025. This flaw allows attackers to conceal malicious commands within Windows LNK files, initiating malware deployment and establishing persistence on compromised systems. The attack necessitates user interaction, specifically the opening of deceivingly crafted Windows Shell Link (.lnk) files. The core of the exploit lies in the way Windows handles LNK files. Attackers leverage a technical limitation—the system's display of LNK files restricts the visible length of the “Target” field to a maximum of 260 characters—to hide the actual, potentially lengthy, command-line arguments associated with the malicious file. By padding the Target field with whitespace, attackers effectively mask the true intent of the LNK file, preventing users from recognizing the dangerous commands being executed. Trend Micro’s analysis, revealed in March 2025, identified 11 state-backed and cybercrime groups involved, including entities such as Evil Corp, Bitter, APT37, APT43 (Kimsuky), Mustang Panda, SideWinder, RedHotel, Konni, and others. These groups utilized malware-as-a-service (MaaS) platforms to distribute and deploy payloads like Ursnif, Gh0st RAT, and Trickbot. The Chinese state-backed Mustang Panda hacking group further demonstrated the vulnerability’s utility in October 2025, targeting European diplomats in Hungary, Belgium, and other European nations. They successfully deployed the PlugX remote access trojan (RAT) malware, highlighting the vulnerability's potential in politically motivated attacks. Initially, Microsoft acknowledged the flaw and stated it would "consider addressing" it, despite the vulnerability not meeting the criteria for immediate servicing. They added a November advisory, stating the vulnerability wasn't considered critical due to the user interaction involved and the system’s built-in warnings regarding untrusted file formats. However, this stance was challenged by ACROS Security CEO and 0patch co-founder Mitja Kolsek, who discovered that Microsoft had quietly altered LNK files in the November updates. This change allowed users to view the complete length of the Target field when opening LNK files, rather than the previously enforced 260-character limit. Despite this adjustment, the underlying technical limitations remain. The compromised LNK file continues to execute malicious commands, and even if users see the full command string, they receive no warning notification. To address this situation, ACROS Security swiftly released an unofficial patch via its 0Patch micropatch platform. This patch limits all shortcut target strings to 260 characters and warns users of the potential danger of opening shortcuts with unusually long target strings. This unconventional solution disrupts malware deployments, offering a tactical advantage given the limitations of Microsoft’s own update. The 0Patch patch is available for 0patch users with PRO or Enterprise accounts, primarily targeting Windows versions reaching end-of-support (Windows 7 through Windows 11 22H2, and Windows Server 2008 R2 through Windows Server 2022). The implementation showcases a reactive approach, recognizing the limitations of Microsoft's immediate response. It’s important to note that while this approach mitigates the attacks in the wild, the underlying vulnerability persists. Furthermore, the patch does not remove the malicious command that exists within the LNK file, and users receive no warnings about opening these links. |