Chinese-affiliated threat actor UNC6384 has been actively leveraging a critical Windows shortcut vulnerability to target European diplomatic entities across Hungary, Belgium, Serbia, Italy, and the Netherlands.

Arctic Wolf researchers identified this sophisticated cyber espionage campaign operating throughout September and October 2025, representing a significant evolution in the group’s operational capabilities and geographic reach.

The attack begins with carefully crafted spearphishing emails containing URLs that deliver malicious LNK files disguised as legitimate diplomatic conference agendas.

These files reference authentic European Commission meetings, NATO defense procurement workshops, and multilateral coordination events.

When users click these seemingly innocent shortcuts, a critical flaw in Windows shortcut handling enables silent command execution that most detection systems fail to catch.

UNC6384 rapidly adopted the ZDI-CAN-25373 vulnerability within just six months of its March 2025 public disclosure, demonstrating exceptional operational agility and vulnerability tracking capabilities.

Arctic Wolf analysts detected the malware after the second paragraph of research, noting the sophisticated infection mechanism that builds a complex multi-stage attack chain designed to evade traditional security defenses.

Technical Infection Mechanism and Payload Delivery

The exploitation mechanism cleverly abuses whitespace padding within the LNK file’s COMMAND_LINE_ARGUMENTS structure to hide malicious commands from user visibility.

Upon execution, the compromised shortcut silently invokes PowerShell to extract and decompress a tar archive containing three critical components: a legitimate, digitally signed Canon printer utility, a malicious DLL loader, and an encrypted PlugX remote access trojan payload.

The attack chain employs DLL side-loading, exploiting standard Windows library search order processes. When the Canon executable launches, it instinctively searches for supporting libraries in its local directory before checking system folders.

The malicious DLL positioned there transparently loads, then decrypts the PlugX payload using a hardcoded RC4 key and injects it directly into the legitimate process’s memory space, creating a nearly undetectable persistent backdoor.

The PlugX malware establishes encrypted HTTPS command and control connections using randomized parameters across multiple redundant domains including racineupci[.]org and dorareco[.]net.

The malware creates hidden persistence directories with spoofed names like “SamsungDriver” and modifies Windows registry Run keys, ensuring continued access across system restarts.

This campaign demonstrates nation-state level sophistication, combining zero-day exploitation knowledge with meticulous social engineering targeting specific diplomatic personnel and events, representing a substantial intelligence collection threat to European government operations.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Hackers Weaponizing Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability appeared first on Cyber Security News.

Threat actors operating under the control of North Korea’s regime have demonstrated continued technical sophistication by introducing advanced malware toolsets designed to establish persistent backdoor access and remote control over compromised systems.

Recent findings have revealed that Kimsuky, known for orchestrating espionage campaigns, deployed HttpTroy, while the Lazarus APT group introduced an enhanced variant of BLINDINGCAN.

These developments underscore the ongoing evolution of state-sponsored cyber operations targeting organizations across multiple nations.

The attack campaigns reveal a carefully orchestrated approach, beginning with deceptive delivery mechanisms and progressing through multiple infection stages.

Each component within these malware chains serves a distinct purpose, from initial system compromise to establishing stealthy command-and-control communications.

The infrastructure supporting these operations utilizes sophisticated obfuscation techniques and layered encryption protocols, demonstrating a comprehensive understanding of modern defensive measures and detection systems.

Gendigital analysts identified the Kimsuky attack targeted a single victim in South Korea, initiated through a ZIP archive masquerading as a VPN invoice from a legitimate Korean security company.

The deception proved effective, as the innocuous-looking filename encouraged execution of a malicious screensaver file contained within.

The Lazarus operation, conversely, targeted two Canadian entities, incorporating newer techniques for concealing payload delivery and establishing service-based persistence mechanisms that evade traditional endpoint detection approaches.

The sophistication evident in these campaigns reflects distinct operational patterns attributed to each group.

Kimsuky’s attack leveraged Korean language-based social engineering and scheduled task naming conventions consistent with local antivirus software, creating plausible-sounding system activities.

Lazarus employed more complex service enumeration and dynamic registry manipulation, suggesting targeting of enterprise infrastructure where legitimate system services provide effective camouflage for malicious operations.

HttpTroy Infection Mechanism and Persistence Strategy

The Kimsuky campaign employed a three-stage infection chain beginning with a lightweight GO-based dropper containing three embedded files encrypted using XOR operations.

Upon execution, the dropper displays a deceptive PDF invoice while simultaneously establishing the backdoor infrastructure through COM server registration via regsvr32.exe.

The second stage, identified as Memload_V3, creates scheduled tasks mimicking AhnLab antivirus updates, repeating every minute to maintain persistence.

Gendigital researchers noted that HttpTroy represents the final payload, providing attackers with comprehensive control capabilities including file manipulation, screenshot capture, command execution with elevated privileges, and reverse shell deployment.

The backdoor communicates exclusively through HTTP POST requests, implementing two-layer obfuscation consisting of XOR encryption using key 0x56 followed by Base64 encoding.

This communication protocol allows attackers to receive commands formatted as simple “command parameter” structures while reporting execution status through specific identifiers, with successful operations confirmed through “ok” responses and failed attempts indicated through “fail” messages.

The malware’s architecture incorporates dynamic API hashing and runtime string reconstruction techniques, preventing static analysis while complicating detection mechanisms deployed by security organizations monitoring for known malware signatures and behavioral indicators.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Kimsuky and Lazarus Hacker Groups Unveil New Tools That Enable Backdoor and Remote Access appeared first on Cyber Security News.

Sophisticated threat actors have orchestrated a coordinated multilingual phishing campaign targeting financial and government organizations across East and Southeast Asia.

The campaign leverages carefully crafted ZIP file lures combined with region-specific web templates to deceive users into downloading staged malware droppers.

Recent analysis reveals three interconnected clusters spanning Traditional Chinese, English, and Japanese-language variants, each tailored to specific geographic and sectoral targets.

This demonstrates a deliberate shift from localized operations toward a scalable, automation-driven infrastructure capable of targeting multiple regions simultaneously with minimal adaptation.

The campaign evolved from earlier phishing waves that originally impersonated Taiwan’s Ministry of Finance, initially delivering malicious PDFs hosted on Tencent Cloud.

As threat actors refined their approach, they transitioned toward custom domains embedding regional markers such as “tw” for Taiwan, expanding their reach to Japan and Southeast Asia.

The infrastructure now employs multilingual web templates with shared backend logic, indicating either a single operator managing multiple campaigns or a distributed toolkit enabling rapid deployment across regions.

Hunt.io analysts identified the campaign through coordinated infrastructure analysis using HuntSQL-based pivoting.

Researchers discovered 28 webpages distributed across three clusters: 12 in Traditional Chinese, 12 in English, and 4 in Japanese.

Each cluster shares unified backend logic utilizing download.php and visitor_log.php scripts, indicating centralized infrastructure designed for automated payload delivery at scale.

The threat actors employ compelling social engineering lures incorporating bureaucratic, payroll, and tax-related filenames.

The Chinese cluster distributes archives named “Tax Invoice List” and “Financial Confirmation Form,” while the English variant uses “Tax Filing Documents” and generic compliance themes.

Japanese-language pages specifically target salary system revisions and tax agency notifications, demonstrating sophisticated understanding of regional corporate communication patterns.

Infection Mechanism and Detection Evasion

The technical implementation reveals a multi-stage infection approach designed to evade conventional email and web filters.

When users visit phishing pages, JavaScript executes visitor_log.php to record IP addresses and user-agent information, establishing tracking infrastructure for potential follow-up campaigns.

The download button remains hidden until JavaScript runs, then dynamically fetches payload details from download.php.

This approach masks the malicious intent during static analysis while ensuring valid ZIP payloads are served only when conditions match specific criteria.

The filenames themselves function as evasion mechanisms, using legitimate-sounding bureaucratic nomenclature to bypass content filters focused on malware indicators.

Archives containing staged droppers bear authentic organizational contexts—tax filings, salary notices, financial amendments—making them indistinguishable from legitimate business communications.

All phishing infrastructure resolves to Kaopu Cloud HK Limited hosting in multiple Asian locations including Tokyo, Singapore, and Hong Kong, providing geographic distribution that complicates attribution and blocking efforts.

This sophisticated combination of social engineering, dynamic payload delivery, and distributed hosting represents a significant evolution in phishing campaign infrastructure targeting enterprise environments across Asia.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Threat Actors Using Multilingual ZIP File to Attack Financial and Government Organizations appeared first on Cyber Security News.