Major hacker groups have ramped up their use of two critical Windows vulnerabilities, triggering a new wave of cyberattacks against infrastructure in dozens of countries. As reported by Ars Technica, citing research from Trend Micro and Arctic Wolf, one of these vulnerabilities has been exploited since 2017, yet Microsoft still has not released a patch — despite seven months having passed since it was publicly disclosed.

CVE-2025-9491: A “Zero-Day” in Shortcuts Exploited Since 2017

The vulnerability CVE-2025-9491 (formerly ZDI-CAN-25373) — classified as a critical information misrepresentation issue in the user interface (CWE-451) — allows attackers to hide malicious code in shortcut (.lnk) files.
Hackers use spaces or special characters to conceal command-line arguments, making them invisible when viewing the shortcut’s properties in Windows. Clicking such a file triggers hidden code, often via PowerShell, leading to the installation of trojans like PlugX.

Although first publicly reported in March 2025, Trend Micro confirms that the flaw has been exploited since at least 2017, by 11 known groups, including state-backed APTs such as APT43 (Kimsuky), Bitter, Mustang Panda, and Evil Corp.
Primary targets: the U.S., Canada, Russia, South Korea, and European diplomatic entities.

  • CVSS score: 7.0/10
  • User interaction required (opening a file)
  • Ideal for phishing attacks

Microsoft was notified in September 2024, but stated that the issue “did not meet the bar for an immediate patch.” This week, Chinese group UNC6384 (Mustang Panda) exploited the flaw to distribute PlugX in Europe via phishing emails themed around NATO and the EU.

CVE-2025-59287: Critical WSUS Flaw — Patch Incomplete

The second vulnerability, CVE-2025-59287, affects Windows Server Update Services (WSUS) and allows unauthenticated remote code execution through unsafe deserialization of untrusted data.

  • CVSS score: 9.8/10
    Attackers send a specially crafted SOAP request to an endpoint such as SyncUpdates, which results in arbitrary code execution with SYSTEM privileges on Windows Server 2012–2025 systems.

Microsoft released a patch on October 14 (Patch Tuesday), but it proved incomplete.
A follow-up out-of-band fix was issued on October 23, and CISA added the flaw to its Known Exploited Vulnerabilities list on October 24, requiring U.S. federal agencies to patch by November 14.

Despite this, Huntress and Sophos observed active attacks after the first patch — including port scans (8530/8531) and PowerShell-based data exfiltration.
A proof-of-concept exploit published on GitHub further accelerated the wave of attacks.

Only servers with the WSUS role are affected, but compromise can enable fake software updates to be distributed across entire networks.

Scale of the Attacks and Consequences

The attacks have hit infrastructure across Europe, Asia, and North America, targeting diplomatic institutions and corporate networks.
UNC6384 focuses on espionage, using PlugX to gain full system access.
Analysts from Palo Alto Unit 42 note a consistent pattern: scanning → remote code execution → reconnaissance.
Risks include:

  • Data theft
  • Lateral movement
  • Supply-chain compromise

Security Recommendations

For CVE-2025-9491 (.lnk zero-day):

  • Block .lnk files in email and at the network perimeter (via Group Policy).
  • Use EDR tools to monitor PowerShell activity.
  • Apply updates once a patch becomes available.

For CVE-2025-59287 (WSUS RCE):

  • Install the October 23 out-of-band patch.
  • Restrict access to WSUS (firewall ports 8530/8531).
  • Disable WSUS if not needed.
  • Monitor for suspicious POST requests and nested PowerShell executions.

CISA and NCSC emphasize the urgency due to a wormable risk in WSUS environments.

In Short

Two Windows vulnerabilities —

  • CVE-2025-9491 (.lnk zero-day exploited since 2017, no patch, CVSS 7.0) and
  • CVE-2025-59287 (WSUS RCE, incomplete patch, CVSS 9.8) —
    are actively used by APT groups such as UNC6384 (Mustang Panda) to spread PlugX and conduct cyber espionage.
    Targets include Europe, the U.S., and Russia.

CISA has added both to its Known Exploited Vulnerabilities list.
Immediate action is urged: patch WSUS, block .lnk files, and monitor network activity.
Microsoft continues to lag behind — your security depends on proactive defense.