Post

ThreatInsight
@threatinsight.proofpoint.com

After a lull in activity targeting Europe from mid-2023 to mid-2025, the China-aligned espionage actor #TA416 (RedDelta, Vertigo Panda, Red Lich) has resumed targeting European government and diplomatic entities, with a recent expansion to the Middle East. brnw.ch/21x1f0j

brnw.chI’d come running back to EU again: TA416 resumes European government espionage campaigns | Proofpoint USKey findings From mid-2025 onwards, the China-aligned threat actor TA416 resumed observed targeting of European government and diplomatic organizations following a period of reduced EU-
ThreatInsight
@threatinsight.proofpoint.com

This renewed focus, observed since mid-2025, most heavily targeted individuals or mailboxes associated with diplomatic missions and delegations to NATO and the EU. The timing aligned with heightened EU–China tensions over trade, the Russia–Ukraine war, and rare earths exports.

0 reposts3 likes

ThreatInsight
@threatinsight.proofpoint.com

In March 2026, after the outbreak of the Iran war, TA416 targeted Middle Eastern govt and diplomatic entities. This was a departure from its usual focus and aligned with a broader shift by state-aligned actors to gather regional intel on the conflict’s trajectory and impact.

ThreatInsight
@threatinsight.proofpoint.com

From mid-2025 to early 2026, TA416 ran web bug and malware campaigns using freemail and compromised accounts, with lures to track engagement and deliver malicious archives via cloud services.

ThreatInsight
@threatinsight.proofpoint.com

The group frequently altered infection chains but maintained core elements of its tradecraft, using tactics like fake Cloudflare Turnstile pages, Entra ID app abuse, and CSPROJ downloaders to deliver PlugX via DLL sideloading.

ThreatInsight
@threatinsight.proofpoint.com

This activity sheds light on TA416’s priorities. Shifting back to targeting Europe & expanding to Middle Eastern gov'ts displays how it's likely influenced by geopolitical flashpoints and escalations. Our blog has details on TA416 campaigns, infection chains, and infrastructure.