China-linked hackers exploit Windows flaw to target diplomats

A group of hackers linked to China, known as UNC6384, has been busy targeting European diplomats and government entities, exploiting a flaw in Windows shortcuts. Between September and October 2025, these attacks hit organizations in Hungary, Belgium, Italy, and the Netherlands, as well as agencies in Serbia.

According to Arctic Wolf, the attack kicks off with spear-phishing emails that contain sneaky URLs leading to malicious LNK files disguised as documents about European Commission meetings and NATO workshops. Once clicked, these files take advantage of an unpatched vulnerability, setting off a chain reaction that ultimately installs PlugX malware. This remote access trojan is designed to give hackers a backdoor into sensitive systems, making it a serious threat to national security. If you’re in the diplomatic sector, now’s the time to double-check your cybersecurity measures.