Technical intelligence and weaponization dossier for CVE-2010-2568. Documented exploitation across 58 active malware families totaling 73,882 analyzed telemetry samples.
| Vulnerability ID | CVE-2010-2568 |
|---|---|
| Common Name / Bulletin | Microsoft Windows Shell Shortcut LNK / PIF Code Execution (Stuxnet) (MS10-046) |
| CWE Classification | CWE-94: Control of Code Generation |
| Affected Software & Versions | Microsoft Windows XP, Vista, 7, Server 2003, Server 2008 |
| Technical Root Cause | Windows Shell improperly parsed Control Panel shortcut (.lnk and .pif) icons, automatically loading and executing DLLs referenced in the icon resource without user consent upon viewing the folder. |
| Associated ATT&CK Techniques |
Empirical catalog telemetry verifies that the following 58 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:
| Malware Family | Category | Catalog Samples | Operational Profile |
|---|---|---|---|
| ramnit | Worm Banker | 20,595 | Ramnit (also known as Nimnul or Cosmu) is a devastating, multi-faceted banking trojan and worm that first emerged in 2010. Originally conceived as a Windows fil... |
| sality | File Infector | 18,572 | Sality is one of the most durable, resilient, and historically significant polymorphic file infectors and botnets in cybersecurity history. First identified aro... |
| wapomi | Worm Banker | 5,191 | Wapomi (widely documented by antivirus laboratories as Virus.Wapomi or Otwycal) is a parasitic polymorphic PE file infector and worm that first surfaced in 2010... |
| gamarue | Loader | 2,789 | Gamarue (widely tracked by security vendors as Andromeda or Wauchos) is one of the most prolific and technically sophisticated modular botnet loaders in the his... |
| virut | File Infector | 1,578 | Virut (also tracked as Virux or W32/Virut) is one of the most destructive, technically complex, and resilient polymorphic file infectors and botnets in cybersec... |
| erazer | Trojan | 1,500 | Erazer (identified across antivirus engines as Trojan:Win32/Erazer and Backdoor.Erazer) is a classic dual-function Remote Access Trojan (RAT) and disruptive dis... |
| erazer_lite | Trojan | 1,500 | Erazer Lite (tracked as Trojan:Win32/ErazerLite and Backdoor.Erazer.Lite) is a streamlined, optimized variant of the parent Erazer remote access trojan codebase... |
| fearless_key_spy | Spyware | 1,500 | Fearless Key Spy (cataloged across security software as Trojan-Spy.Win32.FearlessKeySpy and Spyware.Win32.Fearless) is a specialized Windows keystroke logger an... |
| fearless_lite | Spyware | 1,500 | Fearless Lite (tracked across antivirus engines as Trojan-Spy.Win32.FearlessLite and Spyware.FearlessLite) is a streamlined, low-footprint variant of the Fearle... |
| flux | Backdoor | 1,500 | Flux (cataloged across antivirus solutions as Backdoor:Win32/Flux and Trojan.Win32.Flux) is a classic Delphi-authored remote access backdoor trojan first surfac... |
| hack_a_tack | Trojan | 1,500 | Hack a Tack (cataloged across antivirus vendors as Trojan:Win32/HackaTack, Backdoor.HackaTack, and Trojan.Hack-a-Tack) is a classic remote access trojan and bac... |
| hav_rat | Rat | 1,500 | Hav-RAT (cataloged across antivirus software as Backdoor:Win32/HavRAT, Trojan.Win32.HavRAT, and Backdoor.HavRat) is a classic Delphi-authored Remote Access Troj... |
| hue | Trojan | 1,500 | Hue (cataloged across security engines as Trojan:Win32/Hue, Backdoor:Win32/Hue, and Trojan.Win32.Hue) is a legacy Delphi-authored remote access backdoor trojan ... |
| icecold_reloaded | Rat | 1,500 | IceCold Reloaded (cataloged across security software as Backdoor:Win32/IceCold.Reloaded, Trojan.Win32.IceCold, and Backdoor.IceCold) is a classical Delphi-based... |
| infector_ng_2004 | Trojan | 1,500 | Infector NG 2004 (Infector Next Generation, cataloged across security telemetry as Trojan:Win32/InfectorNG2004, Virus:Win32/InfectorNG, and Trojan.Win32.Infecto... |
| vobfus | Worm | 1,484 | Vobfus (also documented across antimalware products as Win32/Vobfus, Worm:Win32/Vobfus, and WORM_VOBFUS) is a pervasive Windows worm and trojan loader developed... |
| wabot | Rat | 1,185 | Trojan:Win32/Wabot is a prolific modular botnet trojan and worm designed to compromise Windows endpoints and enlist them into large-scale zombie networks for co... |
| yakes | Trojan | 751 | Trojan:Win32/Yakes (widely cataloged across antivirus telemetry as Trojan.Yakes or Win32/Yakes) is a prolific family of obfuscated trojan downloaders and multi-... |
| mira | Worm | 729 | Trojan:Win32/Mira (also tracked across vendor signatures as Worm:Win32/Mira, distinct from the Linux IoT botnet Mirai) is a prolific Windows mass-mailing worm a... |
| qqpass | Infostealer | 612 | Trojan-PSW.Win32.QQPass (broadly cataloged in antivirus telemetry as PWS:Win32/QQPass) is an aggressive, specialized password stealer engineered explicitly to t... |
| agentb | Trojan | 449 | Agent.B (classified across commercial antivirus vendors as Trojan:Win32/Agent.B, Trojan-Downloader.Win32.Agent.b, and Backdoor.Agent.B) is a long-standing, prol... |
| neshta | File Infector | 443 | Neshta (cataloged across cybersecurity authorities as Virus:Win32/Neshta.A, Virus.Win32.Neshta, and Win32/Neshta) is one of the most prolific, long-standing, an... |
| ausiv | Trojan | 422 | Ausiv (cataloged across security vendors as Trojan:Win32/Ausiv, Worm:Win32/Ausiv, and Trojan.Win32.Ausiv) is a hybrid Windows trojan and worm framework that eme... |
| ekstak | Trojan | 421 | Ekstak (cataloged across security software as Trojan.Win32.Ekstak, Trojan:Win32/Ekstak, and Worm:Win32/Ekstak) is a covert Windows backdoor trojan and spyware f... |
| maener | Cryptominer | 387 | Maener (cataloged by security vendors as Trojan:Win32/Maener, Trojan.Win32.Maener, Worm:Win32/Maener, and Bindmaener) is a persistent cryptocurrency mining troj... |
| lolbot | Worm | 374 | Worm:Win32/Lolbot is a notorious worm and remote access trojan that achieved massive global distribution by hijacking instant messaging platforms—including Skyp... |
| zdengo | Adware | 333 | Zdengo (frequently classified by security solutions as Adware.Zdengo, Trojan:Win32/Zdengo, Zdengo.A, and PUA:Win32/Zdengo) is a persistent adware installer, cli... |
| sfone | Worm | 332 | Sfone (cataloged across security vendors as Worm:Win32/Sfone, Worm.Win32.SFONE.B, and Trojan:Win32/Sfone!pz) is a self-propagating Windows worm and trojan loade... |
| snojan | Trojan | 324 | Snojan (cataloged across security research authorities as Trojan.Win32.SNOJAN.A, Trojan:Win32/Snojan, and Backdoor:Win32/Snojan) is a persistent backdoor trojan... |
| shiz | Banking Trojan | 302 | Trojan-Banker:Win32/Shiz is a notorious, historically significant Russian banking trojan that served as a critical evolutionary link connecting early Zeus and G... |
| winwrapper | Pua Tool | 296 | WinWrapper (cataloged by major antimalware vendors as PUA:Win32/WinWrapper, Adware.Win32.WinWrapper, and Trojan.Win32.WinWrapper) is a commercial pay-per-instal... |
| ludbaruma | Worm | 283 | Ludbaruma (identified across antivirus products as Worm:Win32/Ludbaruma.A, Worm:Win32/Ludbaruma!pz, and TrojanDropper:Win32/Ludbaruma) is an aggressive Windows ... |
| olgames | Infostealer | 243 | PWS:Win32/Onlinegames (extensively tracked across security vendor databases as Trojan-PSW.Win32.OnLineGames or PSW.OnLineGames) is a massive, long-running famil... |
| pykspa | Worm | 169 | Pykspa (cataloged across threat intelligence as W32/Pykspa, Worm:Win32/Pykspa, and the Skype Worm Pykspa) is an information-stealing worm that first emerged in ... |
| beebone | Worm | 151 | Beebone (widely cataloged across security vendors as the W32.Worm.Beebone or AAEH family) is a highly aggressive, polymorphic downloader worm first identified i... |
| rebhip | Rat | 120 | Worm:Win32/Rebhip is a stealthy dual-threat worm and keylogging trojan discovered in 2011 that proliferates via removable USB drives and unsecured local network... |
| palevo | Botnet | 106 | Worm:Win32/Palevo (universally known in cybersecurity research as the Butterfly Bot and the Mariposa botnet) was a monumental, highly modular crimeware botnet t... |
| dorkbot | Botnet | 86 | Dorkbot (also tracked across intelligence communities as NgrBot and Worm:Win32/Dorkbot) is a notorious multi-vector worm and modular botnet family that infected... |
| carberp | Banking Trojan | 61 | Carberp is an elite, highly sophisticated banking trojan and modular cyber espionage framework first identified in 2010. Developed by a well-organized Russian-U... |
| equationdrug | Advanced Threat | 25 | Trojan:Win32/EquationDrug is a state-of-the-art cyber-espionage platform attributed by global threat intelligence researchers to the Equation Group (associated ... |
| shylock | Banking Trojan | 21 | Shylock (also cataloged across international law enforcement and intelligence communities as Capito) is a sophisticated financial malware family and banking tro... |
| stuxnet | Advanced Threat | 15 | Stuxnet is widely recognized in military and cybersecurity history as the world's first true cyber weapon, uncovered in June 2010 by VirusBlokAda and subsequent... |
| sinowal | Banking Trojan | 13 | Trojan:Win32/Sinowal (widely documented in cybersecurity research as Torpig and its underlying MBR rootkit Mebroot) is a historic, landmark financial crimeware ... |
| turkojan | Rat | 13 | Backdoor:Win32/Turkojan is a landmark Turkish-origin commercial Remote Access Trojan (RAT) created in the mid-2000s that gained international notoriety for its ... |
| cybergate | Rat | 7 | Trojan:Win32/CyberGate is a classic, widely abused Delphi-based commercial Remote Access Trojan (RAT) that circulated extensively in the underground cybercrime ... |
| institution_2004 | Trojan | Sampled | Institution 2004 (cataloged across security software as Trojan:Win32/Institution2004, Backdoor.Win32.Institution, and Trojan.Institution) is an early 2000s Delp... |
| jbonblanc | Trojan | Sampled | JBonBlanc (cataloged across security software as Trojan:Win32/JBonBlanc, Backdoor.Win32.JBonBlanc, and Trojan.JBonBlanc) is a legacy French-authored Delphi remo... |
| jps | Trojan | Sampled | JPS (cataloged across security software as Trojan:Win32/JPS, Virus:Win32/JPS, and Trojan.Win32.JPS) is the compiled runtime client component generated by the JP... |
| jps_virus_maker | Tool | Sampled | JPS Virus Maker (cataloged across security software as HackTool:Win32/JPSVirusMaker, Tool:Win32/JPS, and Constructor.Win32.JPS) is a classical GUI-based virus c... |
| lanfiltrator | Trojan | Sampled | LanFiltrator (cataloged across security software as Trojan:Win32/LanFiltrator, Spyware.Win32.LanFiltrator, and Trojan.LanFiltrator) is a specialized local area ... |
| lost_door | Rat | Sampled | Lost Door (cataloged across security software as Backdoor.LostDoor, Trojan.Win32.LostDoor, and Backdoor:Win32/LostDoor) is a classic Delphi-authored Remote Acce... |
| messiah | Trojan | Sampled | Messiah (cataloged across security software as Trojan:Win32/Messiah, Backdoor.Win32.Messiah, and Trojan.Messiah) is a classic Delphi-authored remote access troj... |
| netsphere | Trojan | Sampled | NetSphere (cataloged across security software as Backdoor:Win32/NetSphere, Trojan.Win32.NetSphere, and Backdoor.NetSphere) is a classic early 2000s remote admin... |
| nuclear_rat | Rat | Sampled | Nuclear RAT (cataloged across security software as NuclearRAT, Nuclear RAT 2.1, Backdoor.NuclearRat, and Trojan.NuclearRAT) is a classic open-source Remote Acce... |
| prjraptor | Trojan | Sampled | PrjRAPTOR (frequently documented as Project Raptor, PrjRaptor, or Backdoor.PrjRaptor) was an early-2000s hacktool and Remote Access Trojan prominent in the retr... |
| schoolbus | Trojan | Sampled | Schoolbus (cataloged across security software as Backdoor:Win32/Schoolbus, Trojan.Win32.Schoolbus, and Backdoor.Schoolbus) is a classic early 2000s Remote Acces... |
| seed | Trojan | Sampled | Seed (cataloged across security software as Backdoor:Win32/Seed, Trojan.Win32.Seed, and Backdoor.Seed) is a stealthy, lightweight Remote Access Trojan developed... |
| serenity_rat | Rat | Sampled | Serenity RAT (cataloged across security software as Backdoor.Win32.Serenity, Trojan.Serenity, and Serenity RAT) is a mid-2000s Remote Access Trojan created in B... |
Threat intelligence confirms the following adversaries weaponize CVE-2010-2568 in enterprise intrusions and campaign toolkits:
Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2010-2568 in enterprise networks:
File creation of .lnk files on removable USB storage media with Control Panel item GUIDs pointing to absolute binary paths on the drive.SOC containment checklist and attack surface reduction measures to neutralize exploitation:
For end-to-end incident response procedures, consult our dedicated playbook: InfoStealer Protection & Remediation →