Microsoft's Windows operating system has been hit with two vulnerabilities, one of which is a zero-day that has been known to attackers since 2017 and another critical flaw that Microsoft initially tried and failed to patch recently.
Researchers at security firm Trend Micro have confirmed that the first vulnerability, tracked as ZDI-CAN-25373 and later reclassified as CVE-2025-9491, has been under active exploitation for nearly two decades. Attackers began exploiting it in 2017, with some of them using advanced persistent threats (APTs) to install post-exploitation payloads on infrastructure in more than 60 countries.
Months after the initial discovery, Microsoft finally released an unscheduled patch for CVE-2025-9491, but researchers have warned that a second vulnerability, tracked as CVE-2025-59287, remains unpatched and under active exploitation.
This vulnerability stems from a bug in the Windows Shortcut binary format, which allows for faster app invocation without requiring users to navigate to their locations. The vulnerability has been exploited by China-aligned threat group UNC-6384 in attacks targeting European nations, with the attackers using PlugX remote access trojans.
Arctic Wolf researchers have noted that the breadth and speed of this attack suggest either a large-scale coordinated intelligence operation or multiple parallel teams with shared tooling but independent targets. They also observed that consistency in tradecraft across different targets indicates centralized tool development and operational security standards, even if execution is distributed across multiple teams.
Researchers at security firm Trend Micro have confirmed that the first vulnerability, tracked as ZDI-CAN-25373 and later reclassified as CVE-2025-9491, has been under active exploitation for nearly two decades. Attackers began exploiting it in 2017, with some of them using advanced persistent threats (APTs) to install post-exploitation payloads on infrastructure in more than 60 countries.
Months after the initial discovery, Microsoft finally released an unscheduled patch for CVE-2025-9491, but researchers have warned that a second vulnerability, tracked as CVE-2025-59287, remains unpatched and under active exploitation.
This vulnerability stems from a bug in the Windows Shortcut binary format, which allows for faster app invocation without requiring users to navigate to their locations. The vulnerability has been exploited by China-aligned threat group UNC-6384 in attacks targeting European nations, with the attackers using PlugX remote access trojans.
Arctic Wolf researchers have noted that the breadth and speed of this attack suggest either a large-scale coordinated intelligence operation or multiple parallel teams with shared tooling but independent targets. They also observed that consistency in tradecraft across different targets indicates centralized tool development and operational security standards, even if execution is distributed across multiple teams.
. Like, come on, it's been known for years and Microsoft just finally patches it months later 
. And now we're talking about a zero-day that's been around since 2017? That's not new, folks! It's like, attackers were already using this exploit way back when Windows 10 was still in beta 
.
. I mean, sure, it's suspicious that UNC-6384 is involved, but let's not jump to conclusions just yet 
. We need more info before we start blaming everyone from Beijing to Moscow 
.
Windows has been around for ages and still hasn't become as secure as macOS or Linux 
. Maybe it's time for some real change in the Windows camp 
.
. I'm worried about all those countries that got hit by APTs just because of this vulnerability... what if China or Russia were involved? 
Those PlugX remote access trojans sound super scary 
. Microsoft needs to step up their game, like, ASAP 
. And why did it take them months to release a patch for the first one and now the second one is still out there? Not exactly confidence-boosting 
.
.
. I'm just waiting for the patch notes to come out, so I can finally upgrade to Windows 10... or 11... or 2025 
.
. Can't wait for the next update 
. At least the attackers are consistent, right? Using the same old tactics across multiple targets... because who needs originality in cyber attacks anyway? 
I'm tired of waiting for what feels like an eternity to get some basic security updates 
. And now there's another one that they didn't catch? 
That China-aligned threat group UNC-6384 is giving me some major anxiety 
. Anyone else feeling like they're stuck in some kind of tech nightmare? 
]
]
OMG guys! I'm freaking out about this Windows vulnerability news 
. What's even more concerning is that this new vulnerability is still open to exploitation! 
I need a source on this ASAP so I can understand how Microsoft managed to keep this under wraps for so long. How many people are gonna get hacked because of this? 
.
. It's a good reminder to always be on our toes when it comes to cybersecurity 
.
So let's all stay vigilant and keep an eye out for these attacks 
just saying 
! these vulnerabilities are like a ticking time bomb just waiting to be exploited 
... it's crazy that one of them has been around since 2017 and nobody noticed until now 
. Microsoft is doing its best to patch the issues, but it's still a big concern 
!
. Can someone please just patch this already? 
