ZDI-CAN-25373: Windows Shortcut Exploit Abused as Zero-Day in Widespread APT Campaigns

Trend ZDI identified widespread active exploitation of a Windows Shortcut UI-misrepresentation zero-day (ZDI-CAN-25373) that conceals command-line arguments within .lnk files to execute malicious payloads; nearly 1,000 samples tied to multiple state-sponsored APTs (notably North Korean groups) have been observed since 2017, targeting government, financial, telecom, military, energy and other sectors worldwide, and the report provides technical details, detection rules (YARA), hunting queries, IoCs, and Trend mitigations while noting Microsoft declined to patch.