TA416

Reported Context (5)

Proofpoint reported that TA416 resumed espionage campaigns targeting European governments; the article analyzes infrastructure associated with those campaigns. DNS Analysis Maps TA416-Linked Infrastructure and 15 Reported Malicious Domains
The article identifies TA416 as an alias of Mustang Panda, which researchers attribute to the reported campaign targeting Indian financial organizations and US and Korean policy circles. Mustang Panda Campaign Targets Indian Financial Organizations
Proofpoint reports that TA416 resumed targeting European government and diplomatic entities in mid-2025 and expanded to Middle Eastern government and diplomatic targets after the March 2026 Iran conflict. The article describes campaigns deploying updated PlugX backdoors and characterizes the group as aligned with Chinese state interests. Proofpoint Reports TA416 Shift Toward European and Middle Eastern Diplomacy
The article attributes campaigns targeting European government and diplomatic organizations from mid-2025, and Middle Eastern government entities in 2026, to TA416. TA416 Uses Evolving PlugX Delivery Chains to Target European Governments
Proofpoint tracks TA416 as a China-aligned threat actor that resumed targeting European government and diplomatic entities and expanded to Middle Eastern targets. The article attributes web-bug reconnaissance, phishing delivery chains, and PlugX deployment to the group. TA416 Resumes Espionage Campaigns Against European Governments, Expands Into Middle East

Malware (5)

People (3)

Threat Actors (11)

MITRE ATT&CK (19)

Vendors (5)

Products (6)

Tools (2)

Industries (3)

Countries (6)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.