Post

This renewed focus, observed since mid-2025, most heavily targeted individuals or mailboxes associated with diplomatic missions and delegations to NATO and the EU. The timing aligned with heightened EU–China tensions over trade, the Russia–Ukraine war, and rare earths exports.

In March 2026, after the outbreak of the Iran war, TA416 targeted Middle Eastern govt and diplomatic entities. This was a departure from its usual focus and aligned with a broader shift by state-aligned actors to gather regional intel on the conflict’s trajectory and impact.

From mid-2025 to early 2026, TA416 ran web bug and malware campaigns using freemail and compromised accounts, with lures to track engagement and deliver malicious archives via cloud services.