Exploits for Windows Shortcut Vulnerability in the Wild

[Peaches]

Jul22

Exploits for Windows Shortcut Vulnerability in the Wild

Exploits for the recently discovered Windows shortcut vulnerability are now fully out in the wild and affecting users. While earlier samples were seen in more narrowly targeted attacks, the new samples Trend Micro analysts found are now aimed at broader audiences and pose a threat to users at large. Indonesia and India have been particularly hard-hit by this attack, accounting for more than 75 percent of the total number of infections.

However, the good news is that Trend Micro proactively detects shortcut files that exploit this security flaw as LNK_STUXNET.SM. The malware's payloads are also proactively detected as WORM_STUXNET.SM. Earlier variants were already detected as LNK_STUXNET.A, RTKT_STUXNET.A, and WORM_STUXNET.A. This mitigates the risks faced by users dealing with this threat.

According to the Microsoft security advisory page for this vulnerability, this hole presents a number of possibilities for attackers. This is scary and intriguing at the same time.

For a summary of these possibilities read here: http://blog.trendmicro.com/