Suspected Chinese snoops weaponize unpatched Windows flaw

Cyber spies linked to the Chinese government exploited a Windows shortcut vulnerability disclosed in March – but that Microsoft hasn't fixed yet – to target European diplomats in an effort to steal defense and national security details. Security firm Arctic Wolf attributed the espionage campaign to UNC6384 (aka Mustang Panda, Twill Typhoon), and in research published Thursday detailed how the suspected PRC spies used social engineering and the Windows flaw to deploy PlugX malware against personnel attending diplomatic conferences in September and October. "This campaign demonstrates UNC6384's capability for rapid vulnerability adoption within six months of public disclosure, advanced social engineering leveraging detailed knowledge of diplomatic calendars and event themes, and operational expansion from traditional Southeast Asia targeting to European diplomatic entities," the Arctic Wolf Labs threat research team said. UNC6384 is a suspected Beijing-backed crew that, according to Google's Threat Intelligence Group, targeted diplomats in Southeast Asia earlier this year before ultimately deploying the PlugX backdoor – a long-time favorite of Beijing-backed goon squads that allows them to remotely access and control infected machines, steal files, and deploy additional malware. In its latest campaign, UNC6384 targeted diplomats in Belgium, Hungary, Italy, and the Netherlands, along with Serbian government aviation departments during September and October 2025, according to Arc...