Zero-day-cve-2024-4351-report.pdf

ClearSky describes a Windows zero-day (CVE-2024-43451) where specially crafted .url files trigger SMB connections on innocuous actions (right-click, delete, drag), allowing NTLM hash exfiltration and the download/execution of malware (SparkRAT and Redline); the campaign abused downloads from a Ukrainian government site, is attributed to UAC-0194 (suspected Russian), includes detailed IOCs (file hashes, IPs), and Microsoft released a patch on 2024-11-12.