Heise.De

Chinese Hackers Exploit Windows Zero-Day to Target European Diplomats

First seen 23 Nov 2025, 03:35 UTC • Cybernews

•48.6

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

Chinese state-affiliated hackers, identified as UNC6384, have exploited a Windows zero-day vulnerability (CVE-2025-9491) to conduct cyber espionage against European diplomats in countries such as Belgium and Hungary. The attacks, which began in September and October 2025, involved spearphishing emails that delivered malicious LNK files, enabling the installation of PlugX malware for remote access.

Ask AI about this cluster

Answers cite the sources they use

How this analysis works

Attack Flow

20 entities, 47 inferred relationships (STIX 2.1).

Threat Actor (3)

Bronze Butler
Tick
Unc6384

Technique (8)

Malware
Phishing
Zero-day Exploit
T1023 - Shortcut Modification
T1059.001 - PowerShell
T1204 - User Execution
T1566.002 - Spearphishing Link
T1566 - Spearphishing Attachment

Malware (2)

Gokcpdoor
PlugX

Affected Platform (2)

GitHub
Windows

Tool (3)

Canon drivers
Canon printer helper utilities
PowerShell

Vulnerability (2)

Lanscope flaw
LNK display vulnerability

Relationships

Bronze Butler uses Gokcpdoor
Bronze Butler uses PlugX
Tick uses Gokcpdoor
Tick uses PlugX
Unc6384 uses Gokcpdoor
Unc6384 uses PlugX
Bronze Butler uses Canon drivers
Bronze Butler uses Canon printer helper utilities
Bronze Butler uses PowerShell
Tick uses Canon drivers
Tick uses Canon printer helper utilities
Tick uses PowerShell
Unc6384 uses Canon drivers
Unc6384 uses Canon printer helper utilities
Unc6384 uses PowerShell
Bronze Butler uses Malware
Bronze Butler uses Phishing
Bronze Butler uses Zero-day Exploit
Bronze Butler uses T1023 - Shortcut Modification
Bronze Butler uses T1059.001 - PowerShell
Tick uses Malware
Tick uses Phishing
Tick uses Zero-day Exploit
Tick uses T1023 - Shortcut Modification
Tick uses T1059.001 - PowerShell
Unc6384 uses Malware
Unc6384 uses Phishing
Unc6384 uses Zero-day Exploit
Unc6384 uses T1023 - Shortcut Modification
Unc6384 uses T1059.001 - PowerShell
Gokcpdoor exploits Lanscope flaw
Gokcpdoor exploits LNK display vulnerability
PlugX exploits Lanscope flaw
PlugX exploits LNK display vulnerability
Canon drivers exploits Lanscope flaw
Canon drivers exploits LNK display vulnerability
Canon printer helper utilities exploits Lanscope flaw
Canon printer helper utilities exploits LNK display vulnerability
PowerShell exploits Lanscope flaw
PowerShell exploits LNK display vulnerability
Lanscope flaw targets GitHub
Lanscope flaw targets Windows
LNK display vulnerability targets GitHub
LNK display vulnerability targets Windows
Bronze Butler related to T1204 - User Execution
Bronze Butler related to T1566.002 - Spearphishing Link
Bronze Butler related to T1566 - Spearphishing Attachment

Continue Reading

MuddyWater Targets U.S. Entities Amid Geopolitical Tensions Armored Likho Expands Cyber-Espionage with New Rust Toolkit GrayAlpha Threat Actor Uses MaskBat Loader for NetSupport RAT Deployments China-linked Bronze Butler Exploits Motex Lanscope Zero-Day Vulnerability Critical Vulnerabilities Discovered in Mozilla Products Cyber Adversaries Exploit File Enumeration and Data Collection Techniques

Chinese Hackers Exploit Windows Zero-Day to Target European Diplomats

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading