TA416 Resumes Cyber Espionage Against European Governments Amid Geopolitical Tensions

TA416, a Chinese state-backed APT, resumed intensive cyber espionage against European governments and diplomatic/NATO targets from mid-2025 and expanded operations to Middle Eastern government entities after the Iran conflict. The group uses diverse malware delivery techniques—freemail accounts, compromised mailboxes, web-bug reconnaissance, Cloudflare Turnstile abuse, and C# project files—to distribute and deploy a customized PlugX backdoor; the activity was reported active as of April 1, 2026.