UNC6384

A China-nexus espionage cluster with reported overlap to Mustang Panda-related activity. It has targeted diplomats and government organizations in Southeast Asia and Europe using captive portals, fake software updates, malicious shortcuts, and PlugX malware.