Tag: CVE-2025-9491

Attack Groups

Armored Likho Targets Government and Power Sector with BusySnake Stealer

A previously undocumented threat actor, Armored Likho, has been attributed to cyber attacks targeting government agencies and the electric power sector across…

AI-assisted malware AquilaRAT Armored Likho BI.ZONE

July 3, 2026

Critical CVEs

CVE-2025-9491: Windows Shortcut Vulnerability Exploited by Armored Likho

CVE-2025-9491 is a now-patched Windows shortcut vulnerability (ZDI-CAN-25373) that allows remote code execution. Addressed by Microsoft in November 2025 Patch Tuesday, it…

CVE-2025-9491 Microsoft Patch Tuesday remote code execution

July 3, 2026