UNC6384 Weaponizes ZDI-CAN-25373 Vulnerability to Deploy PlugX Against Hungarian and Belgian Diplomatic Entities

The Chinese-affiliated threat actor UNC6384 is exploiting the ZDI-CAN-25373 Windows vulnerability to deploy PlugX malware targeting European diplomatic entities, specifically in Hungary and Belgium. The attack vector involves spearphishing emails with malicious LNK files themed around diplomatic conferences. The campaign uses DLL side-loading of legitimate Canon printer utilities to evade detection and maintain persistence. UNC6384’s operations have expanded from Southeast Asia to Europe, focusing on espionage related to foreign policy, defense, and economic matters. This campaign demonstrates advanced social engineering and rapid exploitation of new vulnerabilities. The malware provides persistent remote access for intelligence gathering. No known public exploits exist yet, but the threat is active and targeted. The medium severity rating reflects the targeted nature and complexity of the attack. European diplomatic organizations should prioritize mitigation to protect sensitive information and maintain operational security.

• The banana stand: brokering and managing infections across Asia using MQTTMalware2026-09-16
• Melofee: a look back at a Linux implant and its new variantsMalware2026-09-10
• CoolClient backdoor goes deeper: Windows kernel rootkit addedMalware2026-08-14
• Analysis of a Modular Cyber Espionage FrameworkMalware2026-08-07
• OctLurk and SilkLurk: new Backdoors in Central AsiaMalware2026-07-30