Are China-linked hackers targeting European diplomatic missions with a new Windows flaw?
Click to start listening
Synopsis
A recent report reveals that a China-associated hacking group, UNC6384, has launched cyberattacks on European diplomatic and governmental entities using a Windows vulnerability. This sophisticated campaign highlights the growing threat of cyber espionage aimed at European alliances and defense strategies.
Key Takeaways
- UNC6384 is a China-linked hacking group targeting European entities.
- The group exploited an unpatched Windows vulnerability.
- Victims included diplomatic missions in several European countries.
- PlugX malware was deployed during the attacks.
- Microsoft Defender can detect and block these threats.
New Delhi, Nov 2 (NationPress) A hacking group associated with China, known as UNC6384, has been identified as responsible for a recent wave of cyberattacks on European diplomatic and governmental entities, as reported by cybersecurity firm Arctic Wolf.
The cyber intrusions occurred between September and October 2025, utilizing an unaddressed vulnerability in Windows shortcuts (LNK) that was highlighted by The Hacker News.
Victims include diplomatic missions in Hungary, Belgium, Italy, and the Netherlands, along with government bodies in Serbia.
According to Arctic Wolf, the attackers employed spear-phishing emails containing links that seemed to reference meetings of the European Commission, NATO workshops, and events for diplomatic coordination.
When users clicked on these links, they were redirected to malicious LNK files meant to exploit the Windows vulnerability tracked as CVE-2025-9491, which has a CVSS score of 7.0.
Upon execution, these files initiated a sophisticated attack sequence that culminated in the deployment of PlugX malware, also referred to as Destroy RAT, Korplug, and SOGU.
This malware grants hackers the ability to take control of infected devices, log keystrokes, transfer files, and extract sensitive information from compromised systems.
Researchers clarified that the LNK files activate a PowerShell command which extracts a concealed archive containing three files: a legitimate Canon printer utility, a harmful DLL file named CanonStager, and an encrypted PlugX payload.
The hackers employ a technique known as DLL side-loading to disguise the malware as a benign application.
The CanonStager malware has shown rapid evolution, with its file size decreasing from 700 KB in early September to a mere 4 KB by October 2025, indicating that the hackers are striving to make it more compact, stealthy, and difficult to detect.
In certain instances, attackers have also utilized HTML Application (HTA) files that fetched external JavaScript from cloudfront[.]net domains to deploy the malware.
This demonstrates that UNC6384 remains committed to refining its tactics to circumvent security measures.
Cybersecurity analysts have also linked UNC6384 to another China-based hacking entity known as Mustang Panda, which is recognized for targeting governmental and diplomatic organizations in both Europe and Asia.
This group has been observed using memory-resident variants of PlugX, referred to as SOGU.SEC.
Experts assert that this campaign aligns with China's objectives of intelligence gathering, particularly to surveil European defense collaborations, policy formulation, and alliance fortitude.
Microsoft has confirmed that its Defender antivirus can identify and neutralize this type of cyber threat, while Smart App Control provides an additional layer of security by blocking harmful files downloaded from the web.
According to Arctic Wolf, the ongoing targeting of European diplomatic establishments underscores China's escalating focus on cyber espionage aimed at understanding the dynamics of European alliances and defense strategies.
Point of View
I emphasize the importance of understanding the implications of these cyberattacks on our national security. The targeting of diplomatic entities by foreign hackers is a grave concern that demands immediate attention and robust countermeasures.
NationPress
04/11/2025
Frequently Asked Questions
What is UNC6384?
UNC6384 is a hacking group linked to China responsible for cyberattacks on European diplomatic and governmental organizations.
What vulnerability did UNC6384 exploit?
UNC6384 exploited an unpatched Windows shortcut vulnerability, tracked as CVE-2025-9491.
What is PlugX malware?
PlugX is a remote access trojan that allows hackers to gain control of infected systems and steal sensitive information.
How can I protect my system from this threat?
Ensure your antivirus software, like Microsoft Defender, is updated, and exercise caution with email links and attachments.
What does this mean for European security?
This campaign highlights the increasing focus of cyber espionage on European alliances and defense strategies, necessitating stronger security measures.
