Chinese Hackers Exploit Windows Zero-Day to Target European Diplomats

Heise.De

Chinese Hackers Exploit Windows Zero-Day to Target European Diplomats

First seen 23 Nov 2025, 03:35 UTC • •48.6

Article Content

1 / 4

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

Chinese state-affiliated hackers, identified as UNC6384, have exploited a Windows zero-day vulnerability (CVE-2025-9491) to conduct cyber espionage against European diplomats in countries such as Belgium and Hungary. The attacks, which began in September and October 2025, involved spearphishing emails that delivered malicious LNK files, enabling the installation of PlugX malware for remote access.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 227d ago How this analysis works

More articles in this cluster (3)

Threat Graph

10 entities, 9 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (1)

UNC6384

Technique (6)

Malware
Phishing
Zero-day Exploit
T1059.001 - PowerShell
T1566 - Spearphishing Attachment
T1574.002 - Dll Side-Loading

Malware (1)

PlugX

Affected Platform (1)

Windows

Tool (1)

PowerShell

Relationships

UNC6384 uses PlugX
UNC6384 uses PowerShell
UNC6384 uses Malware
UNC6384 uses Phishing
UNC6384 uses Zero-day Exploit
UNC6384 uses T1059.001 - PowerShell
UNC6384 uses T1566 - Spearphishing Attachment
UNC6384 related to T1574.002 - Dll Side-Loading
UNC6384 related to Windows

Following this threat?

Track UNC6384 and PlugX in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

China-Nexus UAT-11587 Uses Antino Backdoor for Cyber-Espionage A newly identified cyber-espionage campaign attributed to the China-nexus group UAT-11587 is actively exploiting Microsoft 365 services, specifically Outlook and OneDrive, to deploy the Antino backdoor. This sophisticated attack targets government and policy organizations across Asia and the Middle East. The campaign…

Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…