Experts Warn of New Windows Shortcut Flaw
Summary: VirusBlokAda reported that on June 17 its specialists found two malware samples capable of infecting a fully-patched Windows 7 system when a user viewed an infected USB drive in Windows Explorer, exploiting a flaw in how Windows handles .lnk shortcut files. The malware installs two rootkit drivers, mrxnet.sys and mrxcls.sys, both signed with the digital signature of Realtek Semiconductor Corp., and researcher Frank Boldewin said the samples appeared to target Siemens WinCC SCADA systems.
What's compelling: The malware was built to hunt Siemens WinCC SCADA systems controlling manufacturing and power plants, and Boldewin assessed it was made for espionage - a targeted capability that arrived with a legitimate company's code-signing signature attached.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026