Full Report
Newly discovered vulnerability ZDI-CAN-25373 takes advantage of Windows shortcuts has been exploited by 11 state-sponsored groups since 2017
Analysis Summary
# Threat Actor: 11 State-Sponsored Groups Exploiting ZDI-CAN-25373
## Attribution & Identity
* **Attribution:** The activity is linked to 11 distinct state-sponsored threat groups originating from **North Korea, Iran, Russia, and China**.
* **Known Aliases/Associations:** The article implies that these groups are Advanced Persistent Threat (APT) actors due to their state backing and focus on espionage. Some groups have incorporated this exploit into existing chains, citing **Evil Corp** and campaigns involving **Raspberry Robin** as examples of actors utilizing the vulnerability. The research specifically notes North Korean actors frequently share tools and techniques.
## Activity Summary
* **Vulnerability Exploited:** ZDI-CAN-25373, a vulnerability affecting Windows Shell Link (.lnk) files.
* **Timeline:** Actively exploited by these groups **since 2017**.
* **Operations:** The primary focus of the campaigns linked to this flaw is **cyber-espionage** (approximately 70% of intrusions) and **data theft**. Roughly 20% of attacks were financially motivated, sometimes supporting espionage operations.
## Tactics, Techniques & Procedures
* **Core Technique:** Exploiting the Windows Shell Link (.lnk) file vulnerability (ZDI-CAN-25373).
* **Mechanism:** Manipulating the `COMMAND_LINE_ARGUMENTS` structure within malicious `.lnk` files to insert hidden, executable commands that bypass standard Windows UI scrutiny.
* **Payloads:** Deployment of various malware payloads, including **Malware-as-a-Service (MaaS)** and commodity malware.
* **MITRE ATT&CK IDs:** Not explicitly mentioned in the summary text provided.
## Targeting
* **Sectors:** Government, Private enterprises, Financial institutions (including cryptocurrency platforms), Think tanks and NGOs, Telecommunications, Military and defense, and Energy.
* **Geography:** Global reach, including **North America, Europe, Asia, South America, Africa, and Australia**.
* **Victims:** Not specifically named, but organizations across the high-risk sectors listed above were targeted.
## Tools & Infrastructure
* **Malware Families Used:** Various stage one payloads, including **Malware-as-a-Service (MaaS)** and commodity malware. Specific actor-related tools were not detailed beyond the exploitation technique itself.
* **Infrastructure:** The article focuses on the *exploit* used rather than specific C2 or infrastructure details, though the technique is leveraged across multiple campaigns.
## Implications
* **High Risk:** The vulnerability (ZDI-CAN-25373) has been widely abused for years (since 2017) by numerous state-sponsored actors.
* **Lack of Patching:** Microsoft reportedly declined to release a security patch for the disclosed vulnerability, classifying it as low risk, which leaves organizations exposed unless they implement local mitigations.
* **State Operations:** The activity highlights persistent state-sponsored espionage efforts worldwide, with significant collaboration noted among North Korean groups.
## Mitigations
* Organizations, especially those in high-risk sectors, must **assess their exposure** to ZDI-CAN-25373.
* **Security teams** should remain vigilant for and actively investigate any signs of suspicious **.lnk files**.
* Implementing security mitigations against this specific zero-day vector is urged due to the lack of an official patch.