Chinese APT Exploits Unpatched Windows Flaw in Recent Attacks

According to Arctic Wolf, a Chinese threat actor linked to the Mustang Panda APT has been exploiting an unpatched Windows shortcut vulnerability, tracked as CVE-2025-9491 (CVSS 7.0), in attacks targeting European diplomats. The campaigns use spear-phishing emails containing embedded URLs that initiate an infection chain leading to the delivery of the PlugX remote access trojan, with malicious LNK files designed to run when opened.

ZDI disclosed the issue to Microsoft in September 2024, and Microsoft has not released patches, stating the flaw does not meet the bar for servicing; ZDI released information on the vulnerability in March this year. Arctic Wolf notes that UNC6384, the Chinese threat actor, has exploited CVE-2025-9491 in attacks since September 2025, with targeting that has included Hungarian and Belgian diplomatic personnel and links to Serbian government aviation departments and diplomatic entities in Italy and the Netherlands. The exploits allow PowerShell execution, the dropping of a signed Canon printer utility, and DLL sideloading to run PlugX.