China-Linked Hackers Exploit Windows Shortcut Flaw to Target European Diplomats
Summary: A China-affiliated threat actor tracked as UNC6384 exploited an unpatched Windows shortcut vulnerability, ZDI-CAN-25373 (CVE-2025-9491, CVSS 7.0), to target European diplomatic and government entities in Hungary, Belgium, Italy, the Netherlands, and Serbia between September and October 2025. The chain began with spear-phishing emails carrying lures themed around European Commission meetings and NATO workshops, leading to malicious LNK files that launched PowerShell to extract a TAR archive and deploy the PlugX remote access trojan via DLL side-loading of a legitimate Canon printer utility.
What's compelling: Arctic Wolf reports the CanonStager artifacts shrank from roughly 700 KB to 4 KB between early September and October 2025, a minimal tool built to leave little forensic footprint. The campaign's focus on European defense cooperation and multilateral policy coordination aligns, per Arctic Wolf, with PRC strategic intelligence requirements on European alliance cohesion.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2025-9491
- Related