China-linked UNC6384 exploits Windows zero-day to spy on European diplomats

China-linked UNC6384 exploits a Windows zero-day to spy on European diplomats, according to Security Affairs, with activity attributed to a China-nexus APT group that began in September and remains active. Arctic Wolf Labs researchers outline a three-stage attack chain: a weaponised LNK file launches an obfuscated PowerShell, drops a tar archive in %AppData%\\Local\\Temp, and executes cnmpaui.exe while displaying a decoy PDF.

The tar archive contains a signed Canon utility, a malicious loader DLL and an encrypted blob, and uses DLL side-loading to load a planted cnmpaui.dll that decrypts the RC4-encrypted data to load the PlugX payload into memory. PlugX (SOGU[.]SEC) is deployed via this loader, enabling stealthy in-memory execution and evasion of reputation-based protections, with CanonStager loaders evolving to smaller sizes to reduce forensic footprint.

Targets include diplomatic entities across Hungary, Belgium, Serbia, Italy and the Netherlands, using EU/NATO-themed decoys and a distributed infrastructure with domains such as racineupci[.]org, dorareco[.]net and naturadeco[.]net; C2 activity and other indicators were noted in the report published by Arctic Wolf Labs.

The campaign has been described as a significant national security risk due to sustained intelligence gathering across multiple European nations, with the broader context also highlighted by StrikeReady researchers. 01 November 2025