Post

After a lull in activity targeting Europe from mid-2023 to mid-2025, the China-aligned espionage actor #TA416 (RedDelta, Vertigo Panda, Red Lich) has resumed targeting European government and diplomatic entities, with a recent expansion to the Middle East. brnw.ch/21x1f0j

This renewed focus, observed since mid-2025, most heavily targeted individuals or mailboxes associated with diplomatic missions and delegations to NATO and the EU. The timing aligned with heightened EU–China tensions over trade, the Russia–Ukraine war, and rare earths exports.

In March 2026, after the outbreak of the Iran war, TA416 targeted Middle Eastern govt and diplomatic entities. This was a departure from its usual focus and aligned with a broader shift by state-aligned actors to gather regional intel on the conflict’s trajectory and impact.

From mid-2025 to early 2026, TA416 ran web bug and malware campaigns using freemail and compromised accounts, with lures to track engagement and deliver malicious archives via cloud services.

The group frequently altered infection chains but maintained core elements of its tradecraft, using tactics like fake Cloudflare Turnstile pages, Entra ID app abuse, and CSPROJ downloaders to deliver PlugX via DLL sideloading.