Target Industry
There is a documented history of this vulnerability being exploited by numerous state-sponsored actors. The attacks are characterised as targeted towards specific industries, particularly those involved in sensitive data handling and critical infrastructure. The following industries have been identified by Trend Micro as being at increased risk: government agencies, financial sector, think tanks, telecommunications, military and defence sectors, and the energy sector.
Overview
The Trend Zero Day Initiative has reported ZDI-CAN-25373 as a zero-day vulnerability in Microsoft Windows. Microsoft has yet to assign a CVE ID and has classified this as low severity with no patch coming in the immediate future. This vulnerability has been knowingly exploited by numerous state-sponsored actors in attempts of cyber espionage and data theft since 2017 ([Trend Micro](https://www.trendmicro.com/en_us/research/25/c/windows-shortcut-zero-day-exploit.html)).
This vulnerability stems from a weakness in User Interface (UI) Misrepresentation of Critical Information ([CWE-151]) using whitespace padding. Threat actors can affect how Windows displays shortcut files to a user. Malicious commands can be embedded within .lnk files and hidden from a user’s view within the UI. When a user interacts with the file, it can execute embedded commands, which could download and run malware without the user’s knowledge.
Impact
The history of ZDI-CAN-25373 primarily facilitates espionage and data theft. Targeted sectors with sensitive data would likely face reputational and financial losses. The industries being targeted are likely to be involved in critical infrastructure which could have significant implications.
Vulnerability Detection
The detection of ZDI-CAN-25373 can be challenging due to the nature of the exploit. Until a patch is released, it won’t be possible for end users to identity if this exploit is present through the UI.
Security teams should monitor and investigate any unusual command executions triggered by .lnk files. Detection rules can be used to identify files using padding techniques.
Containment, Mitigations & Remediation
To mitigate the risks associated with ZDI-CAN-25373, organisations should monitor for suspicious processes initiated by .lnk files and implement an effective endpoint detection and response (EDR) solution, such as the Microsoft Defender suite to block the execution of malicious commands or malware once detected.
Indicators of Compromise
Suspicious .lnk files should be inspected for potential whitespace characters that may be padding malicious commands. These include: \x20, \x09, \x0A, \x0B, \x0C, \x0E.
Trend Micro has made available a list of hashes for known sampled files using this technique: [Indicators of Compromise – ZDI-CAN-25373]
Threat Landscape
The threat landscape surrounding ZDI-CAN-25373 is characterised by a diverse range of state-sponsored actors, primarily from North Korea, Russia, Iran, and China. These groups are motivated by espionage and financial gain, with a focus on high-value targets such as government agencies and financial institutions. The ongoing exploitation of this vulnerability highlights the need for organisations to remain vigilant against sophisticated attacks.
Threat Groups
The vulnerability has been exploited by at least 11 state-sponsored advanced persistent threat (APT) groups, with a significant number of attacks attributed to North Korean groups such as APT37 (Earth Manticore) and APT43 (Kimsuky). These groups have demonstrated a high level of sophistication in their attack methods, often utilising zero-day vulnerabilities for espionage and data theft.
Tactics, Techniques and Procedures
Procedures:
- Embedding Malicious Commands in .lnk Files: Threat actors create .lnk files with embedded commands that execute when the user interacts with the file. These commands can download and run malware, establish persistence, or perform other malicious actions.
- Using Whitespace Padding for Obfuscation: To evade detection, threat actors use whitespace characters to pad malicious commands within .lnk files. This makes it difficult for users to identify the embedded commands.
Techniques:
- T1204.002: User Execution: Malicious File
- T1027.012: Obfuscated Files or Information
Further Information
Tags
#APT #ZeroDay #Microsoft #Windows #ZDI-CAN-25373 # T1027 # T1204
