Csoonline

New Techniques Discovered for Abusing Windows LNK Files

First seen 13 Feb 2026, 17:12 UTC • Bleepingcomputer

•36.9

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

Security researcher Wietze Beukema disclosed four new techniques for manipulating Windows LNK shortcut files, allowing attackers to hide malicious targets from users. These methods can facilitate phishing, USB-borne attacks, and other malicious actions without users' awareness. Microsoft stated that these issues do not qualify as vulnerabilities.

How this analysis works

Timeline

2025-08-26

CVE-2025-9491 published

2025-11-07

First public PoC for CVE-2025-9491 released

2026-02-12

Wietze Beukema disclosed new LNK spoofing techniques at Wild West Hackin' Fest

2026-02-13

Csoonline article published discussing new LNK abuse methods

Attack Flow

14 entities, 20 inferred relationships (STIX 2.1).

Threat Actor (2)

Apt37
Apt43

Technique (8)

Malware
Phishing
Social Engineering
Trojan
Zero-day Exploit
T1036 - Masquerading
T1059.001 - PowerShell
T1059 - Command and Scripting Interpreter

Vulnerability (1)

CVE-2025-9491

Malware (1)

PlugX

Affected Platform (1)

Windows

Tool (1)

Lnk-it-up

Relationships

Apt37 uses PlugX
Apt43 uses PlugX
Apt37 uses Lnk-it-up
Apt43 uses Lnk-it-up
Apt37 uses Malware
Apt37 uses Phishing
Apt37 uses Social Engineering
Apt37 uses Trojan
Apt37 uses Zero-day Exploit
Apt43 uses Malware
Apt43 uses Phishing
Apt43 uses Social Engineering
Apt43 uses Trojan
Apt43 uses Zero-day Exploit
PlugX exploits CVE-2025-9491
Lnk-it-up exploits CVE-2025-9491
CVE-2025-9491 targets Windows
Apt37 related to T1036 - Masquerading
Apt37 related to T1059.001 - PowerShell
Apt37 related to T1059 - Command and Scripting Interpreter

Continue Reading

Persistent Firestarter Malware Targets Cisco Firepower Devices in US Agencies MuddyWater Targets U.S. Entities Amid Geopolitical Tensions ScarCruft's Supply-Chain Attack Targets Yanbian Gaming Platform with BirdCall Malware New NarwhalRAT Malware Targets Korean Users via Phishing Emails APT37 Launches Targeted Cyberattack Using Social Media and Tampered Software North Korean Konni Group Uses KakaoTalk for Malware Distribution in Spear-Phishing Campaign

New Techniques Discovered for Abusing Windows LNK Files

Article Content

Timeline

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading