Loading story…
A flaw tracked as CVE-2010-2568 allowed arbitrary code execution on multiple Microsoft Windows versions through crafted .LNK and .PIF shortcut files. The vulnerability stemmed from Windows Explorer improperly handling shortcut files while displaying their icons, meaning malicious code could be triggered simply when a user browsed to a location containing the weaponized shortcut. Affected systems included Windows XP SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 SP2 and R2, and Windows 7.
The issue was observed in the wild and became closely associated with malware activity targeting industrial environments, including reporting tied to Siemens WinCC SCADA-related exploitation. Microsoft identified the issue in advisory 2286198 and addressed it in security update MS10-046, while US-CERT also highlighted the vulnerability as part of broader Microsoft security updates. The bug could be exploited by local users or remote attackers if a victim accessed removable media or network shares containing the malicious shortcut files.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
The CVE record for CVE-2010-2568 was updated. The update date listed in the record is 2018-10-12.
CVE-2010-2568 was published as a Microsoft Windows Shell remote code execution vulnerability involving crafted .LNK or .PIF shortcut files. The record identifies affected Windows versions and links the issue to Microsoft advisory MS10-046.
The Windows Shell shortcut handling vulnerability later tracked as CVE-2010-2568 was demonstrated in the wild in July 2010. The CVE record says it was originally reported in connection with malware leveraging CVE-2010-2772 in Siemens WinCC SCADA systems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has addressed a long-standing security vulnerability in Windows shortcut (.LNK) files, identified as CVE-2025-9491, which allowed attackers to hide malicious commands within shortcut files using whitespace and other characters. This flaw, actively exploited since at least 2017 by multiple state-sponsored threat actors from China, Iran, North Korea, and Russia, enabled remote code execution by concealing hazardous content from users inspecting file properties in the Windows interface. The vulnerability was finally patched as part of Microsoft's November 2025 Patch Tuesday, following public disclosures and pressure from security researchers and organizations such as Trend Micro and ACROS Security's 0patch. The issue was initially dismissed by Microsoft as not meeting the threshold for immediate servicing, despite evidence of widespread abuse in espionage and financially motivated campaigns. Security researchers demonstrated that the flaw allowed attackers to disguise malicious .LNK files as harmless documents, bypassing user scrutiny and leveraging the Windows UI's limitations. While Microsoft eventually issued a silent patch to address the visibility of malicious commands, third-party vendors like 0patch released their own fixes, claiming enhanced protection against known attack techniques. The vulnerability's exploitation history and the delayed response highlight ongoing challenges in prioritizing and remediating UI-based security flaws in widely used operating systems.
Jul 23, 2026
Microsoft confirmed that **CVE-2026-32202**, a patched Windows Shell spoofing flaw, has been actively exploited in the wild after initially publishing incorrect exploitability information. The vulnerability is a **zero-click authentication coercion issue** tied to an incomplete fix for **CVE-2026-21510** and can be triggered when Windows Explorer processes a malicious `.LNK` file. Researchers said the shortcut’s crafted `LinkTargetIDList` can force the system to resolve an attacker-controlled UNC path, causing an outbound SMB connection and NTLM authentication attempt before SmartScreen trust checks occur. Akamai and CERT-UA linked the activity to **APT28**, which used weaponized LNK files in campaigns against Ukraine and several EU countries beginning in December 2025, chaining **CVE-2026-21513** with **CVE-2026-21510** for code execution and then abusing the residual flaw to capture **Net-NTLMv2** hashes for relay attacks or offline cracking. Microsoft addressed **CVE-2026-32202** in its April 2026 Patch Tuesday release, and defenders were urged to patch quickly, monitor outbound SMB traffic, and reduce or harden NTLM usage to limit follow-on credential abuse.
Jun 29, 2026
Security researcher **Wietze Beukema** disclosed four techniques for manipulating **Windows `.LNK` shortcut files** so that Windows Explorer’s Properties dialog can show a benign-looking target while the shortcut actually executes a different (potentially malicious) command. The methods abuse inconsistencies in how Windows prioritizes conflicting target paths across optional LNK structures, including use of forbidden path characters (e.g., embedded double quotes), non-conforming `LinkTargetIDList` values that diverge from `LinkInfo`, and a particularly impactful approach that places the “real” execution path in `EnvironmentVariableDataBlock` while presenting a fake target to the user (e.g., showing `invoice.pdf` while executing PowerShell). This enables attackers to better conceal payload execution and command-line arguments from casual inspection, increasing the effectiveness of LNK-based initial access and social engineering. Microsoft stated the newly presented LNK “spoofing issues” are **not considered vulnerabilities** (per the reporting), framing them as behavior arising from the shortcut format and Explorer’s parsing/display logic rather than a security boundary bypass. Separate coverage emphasized the broader takeaway for defenders: **LNK files should be treated as untrusted** due to their complex binary format and the ease with which attackers can craft deceptive shortcuts that appear legitimate in UI surfaces while launching different programs at execution time.
Jun 29, 2026