China-Linked Hackers Exploit Windows Shortcut Flaw to Target European Diplomats

A China-affiliated threat actor known as UNC6384 has been linked to a fresh wave of attacks between September and October 2025 that exploit an unpatched Windows shortcut vulnerability to target European diplomatic and government entities.

The activity targeted diplomatic organisations in Hungary, Belgium, Italy, and the Netherlands, as well as government agencies in Serbia, with Arctic Wolf saying the campaign uses spear-phishing emails that lure recipients to open a bogus attachment triggering a multi-stage attack delivering LNK files that deploy PlugX.

The campaign leverages ZDI-CAN-25373, officially tracked as CVE-2025-9491 (CVSS 7.0), and culminates in a memory-resident variant of PlugX, known as SOGU[.]SEC, delivered via DLL side-loading and anti-analysis techniques to resist unpacking. The latest operation follows earlier disclosures that XDSpy used the same Windows shortcut flaw to distribute XDigo and that Microsoft Defender detections exist, with Smart App Control providing extra protection.

Arctic Wolf described the malware as enabling extensive remote access, including command execution, keylogging, file transfer, and system reconnaissance, and noted the campaign’s focus on European diplomatic and defence-related targets aligns with strategic intelligence objectives.