New Techniques Discovered for Abusing Windows LNK Files

Csoonline

New Techniques Discovered for Abusing Windows LNK Files

First seen 13 Feb 2026, 17:12 UTC • •36.9

Article Content

1 / 5

Browse articles

ThreatCluster •March 12, 2026 at 16:10 UTC

Security researcher Wietze Beukema disclosed four new techniques for manipulating Windows LNK shortcut files, allowing attackers to hide malicious targets from users. These methods can facilitate phishing, USB-borne attacks, and other malicious actions without users' awareness. Microsoft stated that these issues do not qualify as vulnerabilities.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 217d ago How this analysis works

Timeline

2025-08-26

CVE-2025-9491 published

2025-11-07

First public PoC for CVE-2025-9491 released

2026-02-12

Wietze Beukema disclosed new LNK spoofing techniques at Wild West Hackin' Fest

2026-02-13

Csoonline article published discussing new LNK abuse methods

More articles in this cluster (4)

Threat Graph

14 entities, 20 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (2)

APT37
APT43

Technique (8)

Malware
Phishing
Social Engineering
Trojan
Zero-day Exploit
T1036 - Masquerading
T1059.001 - PowerShell
T1059 - Command and Scripting Interpreter

Vulnerability (1)

CVE-2025-9491

Malware (1)

PlugX

Affected Platform (1)

Windows

Tool (1)

Lnk-it-up

Relationships

APT37 uses PlugX
APT43 uses PlugX
APT37 uses Lnk-it-up
APT43 uses Lnk-it-up
APT37 uses Malware
APT37 uses Phishing
APT37 uses Social Engineering
APT37 uses Trojan
APT37 uses Zero-day Exploit
APT43 uses Malware
APT43 uses Phishing
APT43 uses Social Engineering
APT43 uses Trojan
APT43 uses Zero-day Exploit
PlugX exploits CVE-2025-9491
Lnk-it-up exploits CVE-2025-9491
CVE-2025-9491 targets Windows
APT37 related to T1036 - Masquerading
APT37 related to T1059.001 - PowerShell
APT37 related to T1059 - Command and Scripting Interpreter

Following this threat?

Track APT37, PlugX and CVE-2025-9491 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Mustang Panda Escalates Cyberattacks on European Maritime Sector Chinese hacking group Mustang Panda has intensified cyberespionage campaigns targeting maritime organizations across at least seven EU member states throughout 2025. The European Union Agency for Cybersecurity (ENISA) reported that these attacks primarily focus on espionage and strategic intelligence collection, with…

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…