Windows LNK UI Spoofing Vulnerability Weaponized for Remote Code Execution

A sophisticated cyber espionage campaign targeting European diplomatic institutions has been uncovered, signalling a strategic escalation by UNC6384. Central to the operation is the Windows shortcut (LNK) UI misrepresentation vulnerability—ZDI-CAN-25373, first disclosed in March 2025—paired with social‑engineering that mimics authentic diplomatic conferences. UNC6384, previously documented by Google’s Threat Intelligence Group, is known for sustained targeting of diplomatic sectors.

Arctic Wolf Labs identified that, between September and October 2025, entities in Hungary, Belgium and neighbouring European countries were specifically targeted through a newly evolved attack chain. The attack begins with weaponised LNK files related to European Commission and NATO meetings, running PowerShell to unpack a tar archive and load a malicious DLL via Windows DLL search order side‑loading, which decrypts and injects the PlugX payload into memory for memory‑resident execution.

PlugX enables broad espionage actions such as command execution, file transfer, keylogging and persistence, while disguising itself within trusted processes; mitigation steps include disabling automatic LNK file resolution, blocking known C2 domains, and auditing Canon printer utilities in unusual locations.