Earth Manticore is Trend Micro's Zero Day Initiative designation, equated with APT37, discussed in a March 2025 ZDI report on widespread in-the-wild exploitation of a Windows Shortcut (.lnk) vulnerability, ZDI-CAN-25373, which Microsoft declined to patch. The flaw lets attackers hide malicious command-line arguments inside .lnk shortcut files so they are not visible when a victim inspects the file's properties. Among roughly a dozen state-sponsored groups from North Korea, Iran, Russia, and China found abusing this flaw, ZDI singled out Earth Manticore, alongside the North Korea-linked Earth Imp (Konni), for crafting unusually large, whitespace-padded .lnk files, with a median size around 33 megabytes and samples up to roughly 55 megabytes, to further frustrate detection and analysis. The report situates this technique within a broader wave of exploitation, dating to 2017, by intrusion sets primarily pursuing espionage and data theft against government, financial, telecommunications, and defense-related organizations worldwide.