Two Windows vulnerabilities, one a 0-day, are under active exploitation

Two Windows vulnerabilities, one a zero-day known to attackers since 2017 and the other a critical flaw Microsoft recently attempted to patch, are being exploited in wide-scale operations, researchers say. The zero-day, tracked as ZDI-CAN-25373 and later CVE-2025-9491, was reportedly under active exploitation since 2017 by as many as 11 APT groups, with Trend Micro noting attacks across nearly 60 countries including the US, Canada, Russia and Korea.

Arctic Wolf, reporting on a China-aligned group named UNC-6384, observed CVE-2025-9491 exploits in European targets, delivering the PlugX remote access trojan while encrypting the exploit’s binary with RC4 until the final step.

There is no patch available yet, and the severity for CVE-2025-9491 is 7 out of 10; Microsoft had previously issued an unscheduled update for the other flaw, CVE-2025-59287, a week after an initial patch attempt, only for exploitation to continue, with Huntress, Eye and Sophos all reporting activity since late October. Administrators are urged to investigate promptly and consider blocking or restricting .lnk file usage from untrusted origins to mitigate the threat[.]according to Arctic Wolf