Windows Vulnerability ZDI-CAN-25373: A Decade of Covert Nation-State Exploits

Nation-state hackers have been quietly exploiting a Windows vulnerability since 2017, leaving many organizations exposed to covert attacks. At the center of this drama is a zero-day flaw, tracked by Trend Micro as ZDI-CAN-25373, which manipulates how Windows handles shortcut (.lnk) files. While experts might expect a swift patch for actively exploited vulnerabilities, Microsoft recently declared that the bug “does not meet the bar for servicing,” opting not to issue an immediate update.

The Mechanics: How Does the Vulnerability Work?​

The heart of this vulnerability lies in Windows’ treatment of shortcut files. When users examine the properties of a shortcut, Windows typically displays command-line information. However, clever attackers have discovered a way to insert extensive amounts of whitespace—often in the form of blank spaces—into the command arguments. These invisible characters push malicious commands beyond what the interface displays, rendering the file seemingly harmless. In some extreme cases, North Korean threat actors have engineered shortcut files that reach up to 70MB in size, complicating detection efforts even further.
Key mechanics include:
• Embedding malicious commands in shortcut file properties
• Utilizing extensive whitespace padding to hide harmful code
• Creating abnormally large file sizes to bypass traditional detection methods
This exploitation technique is a reminder that even small software quirks can be transformed into powerful attack vectors—a lesson for all IT professionals.

Nation-State Involvement and Global Impact​

Threat actors linked to nation-states such as North Korea, Iran, Russia, and China have been exploiting this flaw. According to Trend Micro’s research, nearly half of these exploitation campaigns are tied to North Korean groups, with the remaining attacks attributed to other countries. The majority of these attacks appear to be espionage-driven, though financial motivations also play a role in over 20% of the cases.
Sectors at high risk include:
• Government agencies
• Energy companies
• Financial institutions
• Military and defense organizations
• Telecommunications providers
The geographic footprint of these attacks spans North America, Europe, Asia, South America, and Australia, underscoring the global reach of the threat.

Industry Voices: Diverging Perspectives on the Risk​

Prominent cybersecurity experts are divided on the implications of this vulnerability. Thomas Richards, a Principal Consultant in Network and Red Team Practice, voiced surprise over Microsoft’s decision not to patch the flaw. He argued that actively exploited vulnerabilities typically prompt a rapid response and that delaying a patch attributes unnecessary risk to software users.
On the other hand, Jason Soroko from Sectigo noted that the exploitation method requires a confluence of specific conditions—including user interaction and a potential need for elevated privileges via an endpoint compromise. This nuance, he suggests, might explain Microsoft’s assessment of the risk as lower, despite the widespread use by state-backed hacking groups.
These differing perspectives highlight the complexity of vulnerability management: while one camp sees an urgent need for remediation, another suggests that situational factors could be keeping the exploitation confined to specialist scenarios.

Historical Disputes and the Broader Context​

This isn’t the first time the cybersecurity realm has seen friction between vulnerability researchers and Microsoft. In a similar vein to previous disputes, the Zero Day Initiative (ZDI) has criticized Microsoft for its handling of security disclosures—this time for not acknowledging or patching a remotely dangerous flaw despite evidence of exploitation spanning several years. Researchers like Haifei Li from Check Point have also raised concerns about the lack of transparent communication regarding the vulnerability.
When vulnerabilities like this go unpatched, organizations face the dual challenge of mitigating known risks while also grappling with the uncertainty of hidden threat actors. The historical context of evasive patching and industry disputes amplifies the call for heightened internal security measures.

Practical Recommendations: How to Stay Protected​

With millions of users potentially exposed to this unpatched flaw, cybersecurity vigilance is more critical than ever. Experts recommend several proactive strategies:
• Deploy and maintain a robust Endpoint Detection and Response (EDR) solution to flag and mitigate malicious .lnk files.
• Monitor network traffic vigilantly for any signs of suspicious activity that might indicate an exploitation attempt.
• Educate users on the risks of interacting with unfamiliar shortcut files and suspicious links.
• Stay updated on industry security alerts and be prepared for any changes in Microsoft’s stance on the vulnerability.
While a patch may eventually be released, these countermeasures are essential for organizations across various sectors that remain on the frontline of cybersecurity defense.

Final Thoughts​

The emergence of the ZDI-CAN-25373 vulnerability—exploited by multiple nation-state hackers over several years—serves as a sobering reminder of the intricate cat-and-mouse game in cybersecurity. Microsoft’s decision not to deploy a patch immediately has sparked debate among experts and left organizations in a state of heightened risk. As new evidence surfaces and the dynamic threat landscape evolves, IT security professionals must rely on layered defenses, continuous monitoring, and user education to navigate these turbulent waters.
Are you taking the necessary precautions to protect your organization’s Windows environment? The evolving nature of threat actors and the sophistication of their exploits underscore the importance of being proactive rather than reactive in cybersecurity management.

---

Source: HackRead 11 Nation-State Hackers Exploit Unpatched Windows Flaw Since 2017