TA416 Targets European And Middle East Diplomats

Proofpoint reports that China-aligned threat actor TA416 resumed targeting European government and diplomatic entities from mid-2025 and expanded into Middle Eastern diplomatic and government targets in March 2026 after the Iran conflict outbreak. The group ran multiple web-bug reconnaissance and malware-delivery campaigns, frequently changing infection chains—abusing Cloudflare Turnstile pages, OAuth redirects, and C# project files—and delivered a customized PlugX backdoor via DLL sideloading triads. This demonstrates evolving tradecraft and regional intelligence collection.