Stealth Fix: Microsoft Patches Exploited LNK Security Hole

In a move that highlights the ongoing cat-and-mouse game between software vendors and threat actors, Microsoft has recently addressed a high-severity vulnerability in Windows LNK files. Tracked as CVE-2025-9491, this flaw has been actively exploited in the wild by a multitude of state-sponsored and cybercriminal groups. The vulnerability allows attackers to embed malicious commands within Windows shortcut files, leading to malware deployment and persistent access to compromised systems.

The crux of the vulnerability lies in the way Windows handles .LNK files. By padding the Target field with whitespaces, attackers can conceal malicious command-line arguments. This ensures that when a user examines the file’s properties, only the initial 260 characters are visible, effectively hiding the true command that gets executed upon double-clicking the shortcut. This deceptive technique allows for the execution of arbitrary code without the user’s explicit knowledge, making it a potent tool for malicious actors.

The impact of this vulnerability is significant, as successful exploitation can lead to a range of malicious outcomes. By leveraging the ability to hide commands within LNK files, attackers can deploy various types of malware, establish persistence on compromised systems, and potentially gain full control over the affected devices. The fact that this vulnerability has been actively exploited by a diverse range of threat actors, including state-sponsored groups and cybercrime gangs, underscores its severity and the potential for widespread damage.

Trend Micro’s threat analysts discovered that CVE-2025-9491 was actively exploited by at least 11 different groups, including notable players like Evil Corp, Bitter, APT37, APT43 (Kimsuky), Mustang Panda, SideWinder, RedHotel and Konni. These groups have been observed using the vulnerability to deliver various malware payloads, including Ursnif, Gh0st RAT, and Trickbot. Furthermore, Arctic Wolf Labs reported that Mustang Panda exploited this vulnerability in zero-day attacks against European diplomats, deploying the PlugX RAT.

Threat actors are actively exploiting this vulnerability to deploy malware and maintain a foothold on compromised systems. Understanding their TTPs is crucial for effective defense:

• TA0005 – Defense Evasion: Attackers use obfuscation to hide malicious commands within LNK files, making it difficult for users and security software to detect the threat.
• TA0002 – Execution: The vulnerability relies on user interaction to execute the malicious LNK file, highlighting the importance of user awareness and training.
• TA0003 – Persistence: By exploiting this vulnerability, attackers can establish persistent access to compromised systems, allowing them to maintain control even after a reboot.
• T1027 – Obfuscated Files or Information: Padding the Target field in Windows .LNK files with whitespaces to hide malicious command-line arguments.
• T1204 – User Execution: Malicious arguments not showing in the Target field.
• T1060 – Registry Run Keys / Startup Folder: Attackers use the vulnerability to deploy malware and gain persistence on compromised devices.

Microsoft has implemented a silent mitigation in its November updates, modifying LNK files to display all characters in the Target field. However, this measure does not remove malicious arguments or warn users about potentially dangerous LNK files.

For more robust protection, consider the following:

• Apply Unofficial Patches: ACROS Security offers a micropatch via its 0Patch platform that limits shortcut target strings to 260 characters and warns users about suspicious shortcuts.
• User Education: Train users to be cautious when opening LNK files, especially those received from untrusted sources or distributed in archives.
• Endpoint Protection: Implement endpoint security solutions that can detect and block malicious LNK files based on their behavior and characteristics.

Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.

It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.

Experience the fastest and most accurate patching software here.