Unpatched Windows vulnerability continues to be exploited by APTs (CVE-2025-9491)

A Windows vulnerability (CVE-2025-9491, aka ZDI-CAN-25373) that state-sponsored threat actors and cybercrime groups have been quietly leveraging since at least 2017 continues to be exploited for attacks. “Arctic Wolf Labs assesses with high confidence that [the campaign they detected] is attributable to UNC6384. This attribution is based on multiple converging lines of evidence including malware tooling, tactical procedures, targeting alignment, and infrastructure overlaps with previously documented UNC6384 operations,” the company’s threat researchers noted. The attack … More →

The post Unpatched Windows vulnerability continues to be exploited by APTs (CVE-2025-9491) appeared first on Help Net Security.