Do Son Researcher @goyaramen reveals how PRC threat actors like Mustang Panda use expired domains and Cloudflare to mask their PlugX C2 infrastructure.
UNC6384
Arctic Wolf exposed Chinese APT UNC6384 exploiting the ZDI-CAN-25373 Windows LNK flaw to target European diplomats. The multi-stage attack uses DLL sideloading via a Canon binary to deploy the PlugX RAT.
A new Google report reveals a Chinese APT group is hijacking captive portals and disguised plugins to deliver malware for espionage against diplomats in Southeast Asia.