UNC6384 Targets European Diplomatic Entities With Windows Exploit

UNC6384, a China-linked threat actor, has targeted European diplomatic entities with a Windows exploit in a cyber-espionage campaign running since September and centred on Hungary and Belgium. The group has incorporated CVE-2025-9491, a high-severity Windows vulnerability, into its attacks alongside what Arctic Wolf researchers describe as refined social engineering.

Spear-phishing emails present links that deliver malicious LNK files, imitating European Commission meetings and NATO-related events to lure diplomats, with the Windows vulnerability exploited before obfuscated PowerShell commands deploy a malware chain. This culminates in the deployment of PlugX, also known as Destroy RAT, SOGU, Kaba, Korplug and TIGERPLUG, a tool used for remote access and capable of anti-analysis techniques to evade detection.

The campaign is expanding across Europe to governments in Italy, the Netherlands and Serbia, with UNC6384’s previous activity involving diplomats in Southeast Asia, according to Arctic Wolf researchers. The report notes the US DOJ and the FBI recently concluded efforts to delete PlugX from thousands of devices worldwide, underscoring the ongoing risk to diplomatic networks.