Chinese APT UNC6384 Pivots to Europe, Exploits Windows LNK Flaw to Deploy PlugX via Canon DLL Sideloading

According to Arctic Wolf, UNC6384, a Chinese-affiliated threat actor, has expanded its operations from Southeast Asia to Europe, targeting Hungarian and Belgian diplomats and other EU government entities during September–October 2025. The campaign blends rapid adoption of a Windows shortcut vulnerability, ZDI-CAN-25373 disclosed in March 2025, with social engineering themed around European diplomatic events to deliver its payload.

The intrusion chain begins with spearphishing emails containing malicious Windows LNK files that execute obfuscated PowerShell, loading a Canon printer utility, a malicious DLL, and an encrypted PlugX payload; a decoy PDF masquerades as a European Commission meeting agenda. The attack uses DLL side-loading of a legitimate Canon-signed binary, cnmpaui.exe, to load cnmpaui.dll which decrypts the PlugX blob cnmplog.dat into memory, enabling remote access and other capabilities.

PlugX, a long-standing RAT, is deployed with in-memory execution and includes C2 infrastructure using multiple domains over HTTPS with Let’s Encrypt certificates. Arctic Wolf notes a rapid refinement of the CanonStager loader, shrinking from 700KB to 4KB between September and October 2025, to improve stealth.