Windows WebDAV CVE-2025-33053: Stealth Falcon Zero-Day

What to do

1. Confirm every Windows host runs the June 10, 2025 cumulative update or later.
2. Disable the WebClient service where nobody needs WebDAV drive mapping, which removes the remote working directory path.
3. Block .url, .lnk and .website attachments and archives that contain them at the mail gateway.
4. Block the Stealth Falcon domains Check Point published at DNS and the proxy.
5. Rebuild any host that shows the Horus Loader chain and rotate domain credentials if a domain controller was touched.

How to check if you are affected or compromised

• Check the build: Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select CurrentBuild, UBR, and compare with the fixed builds.
• Hunt for iediagcmd.exe starting route.exe or other helpers from any path outside C:\Windows\System32, especially a WebDAV path.
• Search mail and file telemetry for TLM.005_TELESKOPIK_MAST_HASAR_BILDIRIM_RAPORU.pdf.url and other .pdf.url double extensions.
• Search DNS and proxy logs for summerartcamp[.]net, mystartupblog[.]com, roundedbullets[.]com, downloadessays[.]net and purvoyage[.]com.

What happened#

On June 10, 2025, Microsoft's Patch Tuesday fixed CVE-2025-33053, an "external control of file name or path" flaw (CWE-73) in how Windows handles Internet Shortcut (.url) files. A user who opens a crafted shortcut can end up running code from a remote WebDAV server. Microsoft rates it Important, CVSS 3.1 8.8, and marked it exploited. On June 19 it renamed the advisory from a WebDAV bug to an Internet Shortcut Files bug. The June CVRF data credits Alexandra Gofman and David Driker of Check Point Research. CISA added it to the KEV catalog the same day, with a July 1 deadline.

Check Point's report, also published June 10, explains the trick. The .url file points at a real Windows program, iediagcmd.exe, an Internet Explorer diagnostics tool. But it sets WorkingDirectory= to an attacker's WebDAV share. When iediagcmd.exe starts helpers such as route.exe, Windows looks in the current folder first and runs the attacker's copy. There is no memory corruption: a trusted Windows tool simply launches the wrong file.

Check Point attributes the attack to Stealth Falcon (also called FruityArmor), an espionage group focused on the Middle East and Africa. It has hit government and defense targets in Turkey, Qatar, Egypt and Yemen. In March 2025, Check Point caught an attempt against a Turkish defense company. The lure was TLM.005_TELESKOPIK_MAST_HASAR_BILDIRIM_RAPORU.pdf.url, a fake "telescopic mast damage report." It started Horus Loader, which showed a decoy PDF and loaded Horus Agent, a custom implant for the open-source Mythic command-and-control framework. The group's other tools include a keylogger, a passive backdoor (usrprofscc.exe) and a domain controller credential dumper.

Who is affected#

The CVE record lists every Windows version then supported, from Windows 10 1507 and Server 2008 SP2 through Windows 11 24H2 and Server 2025. Fixed builds include 19045.5965 for Windows 10 22H2, 22631.5472 for Windows 11 23H2, 26100.4349 for Windows 11 24H2 and Server 2025, and 20348.3807 for Server 2022. Microsoft says older servers on security-only updates also need the June IE cumulative update.

Do you really need to act?#

For most organizations, this was a narrow, targeted espionage campaign, and the fix is 16 months old. Any host updated since June 2025 is covered. The lasting lesson is the technique. Shortcut files that pull code or credentials from a remote share keep coming back, and a patch closes one path at a time. Two settings remove much of that risk. Disable the WebClient service where nobody maps WebDAV drives. Block .url and similar shortcut files in email. Also note that Windows 10 devices without Extended Security Updates have had no fixes since October 14, 2025.

What to do now#

1. Check builds with Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select CurrentBuild, UBR and update anything behind.
2. Where WebDAV is not needed, run Stop-Service WebClient; Set-Service WebClient -StartupType Disabled, or push the same setting by Group Policy.
3. Strip .url, .lnk and .website files, including inside archives, at the mail gateway.
4. Block the domains listed below at DNS and the proxy.

How to tell if you were hit#

• Hunt in EDR for iediagcmd.exe starting route.exe or other helpers from outside C:\Windows\System32, especially a UNC or WebDAV path.
• Search mail for the lure name above and for any .pdf.url double extension.
• Search DNS and proxy logs for summerartcamp[.]net, mystartupblog[.]com, roundedbullets[.]com, downloadessays[.]net and purvoyage[.]com, and match Check Point's file hashes.
• Look for an unknown service running usrprofscc.exe, and for copies of NTDS.dit, SAM or SYSTEM on domain controllers.

Timeline#

• Mar 2025 — Check Point detects the attempted attack on a Turkish defense company.
• Jun 10, 2025 — Microsoft fixes the bug and marks it exploited. Check Point publishes its research. CISA adds it to KEV.
• Jun 19, 2025 — Microsoft corrects the advisory title and description.
• Jul 1, 2025 — CISA's remediation deadline for federal agencies.

Vulnerability records

• CVE-2025-33053 · KEV 2025-06-10 · External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Microsoft MSRC — CVE-2025-33053 Internet Shortcut Files Remote Code Execution Vulnerability msrc.microsoft.com
2. Microsoft MSRC — June 2025 Security Updates (CVRF data with KB numbers and acknowledgments) api.msrc.microsoft.com
3. Check Point Research — Stealth Falcon's Exploit of Internet Shortcut File Zero-Day CVE-2025-33053 research.checkpoint.com
4. CVE record — CVE-2025-33053 cve.org
5. NVD — CVE-2025-33053 nvd.nist.gov
6. CISA — Known Exploited Vulnerabilities: CVE-2025-33053 cisa.gov
7. Microsoft Support — Windows 10 support has ended on October 14, 2025 support.microsoft.com