Skip to main content
Press slash or control plus K to focus the search. Use the arrow keys to navigate results and press enter to open a threat.
Reconnecting to live updates…

TA416 resumes European government espionage campaigns

0
Medium
Published: Tue Apr 07 2026 (04/07/2026, 11:11:35 UTC)
Source: AlienVault OTX General

Description

Since mid-2025, China-aligned threat actor TA416 has resumed targeting European government and diplomatic organizations after a two-year operational shift to Southeast Asia. The campaigns primarily focused on diplomatic missions to the EU and NATO, using web bug reconnaissance and malware delivery through compromised accounts and attacker-controlled infrastructure. In March 2026, TA416 expanded operations to Middle Eastern diplomatic entities following the Iran conflict outbreak. Throughout this period, the actor continuously evolved infection chains, utilizing fake Cloudflare Turnstile pages, OAuth redirect abuse, and C# project files to deliver a customized PlugX backdoor via DLL sideloading. The group employed both broad reconnaissance campaigns and targeted malware delivery, demonstrating sophisticated tradecraft including use of re-registered legitimate domains and cloud infrastructure for command and control operations.

AI-Powered Analysis

Machine-generated threat intelligence

AILast updated: 04/07/2026, 11:31:22 UTC

Technical Analysis

TA416 is a China-aligned threat actor that resumed targeting European government and diplomatic entities starting mid-2025 after a two-year focus on Southeast Asia. The campaigns primarily target diplomatic missions to the EU and NATO, employing web bug reconnaissance and malware delivery through compromised accounts and attacker-controlled infrastructure. In March 2026, operations expanded to Middle Eastern diplomatic targets following the Iran conflict outbreak. The actor uses sophisticated infection chains including fake Cloudflare Turnstile pages, OAuth redirect abuse, and C# project files to deliver a customized PlugX backdoor via DLL sideloading. Their tradecraft includes use of re-registered legitimate domains and cloud infrastructure for command and control, combining broad reconnaissance and targeted malware delivery.

Potential Impact

The campaigns enable espionage against European and Middle Eastern diplomatic organizations, potentially compromising sensitive government communications and operations. The use of customized PlugX backdoors and advanced infection techniques indicates a high level of persistence and stealth, increasing the risk of prolonged unauthorized access and data exfiltration. The threat actor's ability to evolve infection chains and abuse legitimate infrastructure complicates detection and mitigation efforts.

Mitigation Recommendations

No specific patch or remediation is available as this is an espionage campaign using malware and social engineering techniques rather than a software vulnerability. Organizations should apply threat intelligence to detect indicators of compromise related to TA416, such as suspicious OAuth redirects, fake Cloudflare Turnstile pages, and DLL sideloading activity associated with PlugX. Monitoring for compromised accounts and unusual network traffic to attacker-controlled infrastructure is recommended. Since no official fix exists, defensive measures should focus on detection and response capabilities tailored to these tactics.

Pro Console: star threats, build custom feeds, automate alerts via Slack, email & webhooks.Upgrade to Pro

Technical Details

Author
AlienVault
Tlp
white
References
["https://www.proofpoint.com/us/blog/threat-insight/id-come-running-back-eu-again-ta416-resumes-european-government-espionage"]
Adversary
TA416
Pulse Id
69d4e667e8ab2d6d4082fc5b
Threat Score
null

Indicators of Compromise

Hash

ValueDescriptionCopy
hash0538e73fc195c3b4441721d4c60d0b96
hash06fcc2a56de5acdf1ca1847c79cca9e9
hash0749f8e05b6f0b4d200eadb4f7bb28e4
hash0aad27ddd173bfae8009b1ecb46f29b0
hash0f9bf9bdfc6f9471345a6a64bb0e57da
hash2226d3e8843b3e2c228da3a3fdc56e7b
hash319e0fce4e637a5412e125d6c99348d7
hash381247c1d4c68a406237d7d3aa030930
hash42fd91f217aeaeef241a27962643d070
hash52f6beda7097db23ec1b395eff9efb4a
hash5c92f0a474846a8df4aaff5c3b16af34
hash637dbccf9d5d5fb9e41cadbf0803bc55
hash65658848c424482eaa4bac6e53c25146
hash69f3f25b4049e8ed198ba2c76a2a137f
hash769687f93869a70511aac1ef7c752455
hash7a183bd25d190662c3008c794f6cb604
hash7a75e713db41c28378e823322fdea0fd
hash7ca528c170164f9945c87d5ba673b7b0
hash80fc64b636834e85ed58220d456cd5c5
hash8a1a090b2c5de4a3c31b4062685aff9f
hash90edc0cecd3f762c36a38a5642e0d939
hash95254a16917d2c458ea5143ad35373cd
hash9a574029357cbbba709a18f8d34df77f
hasha12357ff6c0f7b021f32b0c9cd3d01c4
hasha29e49a21bf3469a0044be2e2b989ad3
hasha8082a80cef9ccee9d7a35f5366e3afb
hasha9c77dbe140490c5a22c3ae2536a8b32
hashadb67ffe941a706b6343f94413f6e5f2
hashbbcfb30c493faa48c07d1d46c9daf8da
hashbd6c687a3908052ee14b7d5178442a72
hashc24a8d717176ba9b1e53991b13ef9ba9
hashc27462566a4cc90b015664ab55caa250
hashc3c98201b693760f4de8495595ebbe7d
hashc647e6e683a88af07d861847a18468f8
hashd71ff71b7d5b7daf4ad892b0e7baca03
hashdd82199fe9a36850aaaa6bf28293380a
hashddd5f542c15be47f9e1d8a52768a1b1a
hashe78d4f1f53123ceffedac6d4698438b9
hashe7cb954f4bbdbadbd2c0206577621683
hashf15c9d7385cffd1d04e54c5ffdb76526
hashf331af4c164a40d13b24def0818e0198
hashf517f01384310145d989ec45a649d9c3
hashfa107167ff9303c06c8c7c518a7a1923
hashfb56f1d79d491a2557112d072baf5ab2
hash0252819a4960c56c28b3f3b27bf91218ffed223a
hash0913be3e99bc53232db6c5213a578e999c70deb8
hash0de54e53ea7eb2256608fd818a2733d67e1089f5
hash0f203358170d69c2ca2995fdc8adb9d9a7f47d5a
hash1039ae50b6274c01510df396d962579828f025bf
hash1151100a0aa1ed88f7897709444fd3b3b1044c10
hash15e9d47e34861fb6ebe27b5d683014ed4b49e39f
hash1612f489f8a6b28cbc727b9489d5e972f3bce5de
hash258d5d6cbdec6494415a09ffe707dd724d9535cd
hash28f88998f2d99a579572d3641f7549e08147f471
hash2989aa779d95c9e2d8cb3a65e2cb05203f0d562a
hash2c16f2830aa36848ca61272c2e4305102bfad537
hash39f6799543e18d9ebc68099e62a30f2e67913034
hash3aa6baf0265b2789dae0548b5284d4158c8c256b
hash43d6ddc2de9c01cdb5ef17ee4e3d88289fa51a23
hash49e02aee84df430d7ae448d7cd722401f8a2c9f5
hash596b582169f5d65c4791477a61099c03fbb63a41
hash68932940cebf56bb2fe65e4cf53781a97579599a
hash7552c901c68b9d57c7b6c29a34ff7cf4441b2047
hash76e7ba416a8dda8e761c62ceb215ab9611ef5b6e
hash7d5c92191b9857a708fdebc996cc6f10cf5ed7e4
hash83f522a490b6851aa9b30c1ec63c576e1fc120e5
hash88889d7a7ca00f7a4f4611b5c4db51a1f744fcf6
hash8ec98b77cf9f01bc88b3ae82749256d56a100f64
hash91704137f33d66ae494ae0c2e7d002df6c3c3068
hasha019aaa7b90bca17ef8f9910db3ad7c0a3c2afe4
hashad833604d230b241e180950980ea462b3812f82a
hashaf99d1da4e1e272f54c8bd7f3eedaaa7bbfd9628
hashb0a380e1387dc8e65553350b2851747de7177299
hashb4dba13f8777ed6578df8beb879ed664590958b5
hashb4de571f772316c0fd6a7e74e3577ae6d3eb54db
hashbaa569318144905563b469a5a006ad54eb616a02
hashbfb86c579e8a6ffc30b9976eb494fbed63939361
hashbffb14c389ce70d00eff88e6fb151629d589efc6
hashcad73d8b5710c0784d95edd6766b0bfdb0fd7382
hashd1a86ed06b18efef5ce724d2129cf1583b779b44
hashe34f1632b45fcff76e6c8e321e87e9e0d28cab59
hashe9aa4858ed341e964609b060138f3e37d5202345
hashf049bf58b9362fc474c1d543b085f39a4134edab
hashf06da8e29c3f0fafabfc3a524ae8b21730b57ed3
hashf4183780f6684b1eb82e5556654be329da5a6843
hashf5ce76038ffbb80bec76ea0c8aabe944ec92777c
hashf9dd7f8846dc10164b348cfdf878a611c79e4c00
hashff6486815bdbf1a7b7c8035a6cf8d0157a2a778f
hash06a70c54c580ec4c362bfbc94147a0f1ac9020c421933ccf494a8d553b114260
hash0b916d2b4a02d01b42c2b04e281d786a05cc7974d2c4a272b01e8060fa713403
hash16e258b7b712b747a6037d56ee8d2cc99f8f8139da4a3a59c24af0887531ace0
hash1df74ce45aa9320c48858eddce3f46f5687fbfdcfd497d92a1e17476e7a2951e
hash2261c7640fe2f3c2385de61c546b5020ec8a486ad5bad64c31bc9268f6b36a2c
hash262a1003a2cd04993b29e687686eba573d6202fea8611c437ecbd6312802677a
hash2712f4ac5ad422bcf749699389cb1a0111a1b11e298efb0cffebc2e2f0becb5f
hash28a8bdaee803d9cf9186ff4756e15b0fb491fd3b65bde002361615f27e5ca92d
hash29a70241660ff3234f1c5e8c01878ee01adb4a289262bd37403e1a323129ea86
hash29cd44aa2a51a200d82cca578d97dc13241bc906ea6a33b132c6ca567dc8f3ad
hash2c3708a103b257fa75fcb34948c817fd564d4479f1e267b33c5b08f0d4c7634f
hash3021f4d365a641722748c5e60d983a080db17bef8f0a1dbe624ffe63cd544cc1
hash30475ff5b32776e554433ff00e7c18590253521024662c267abaefd24f1b9bbe
hash30c71d644bc72e0d55d46bed753ab3f72dc77b7f1be0e34693c957939a779507
hash31f3606433e95bfbb047d31c885e56a70111e130f3d2da0580644c01323b46d1
hash36e516182b4c8aa48ea3e50b7dc353f32d3412f59fb0cb1c7b3590aa4d821c57
hash3c065947461df428b0d29e401e2a28a0d2560943e96d3ac8b9ed71858fbcec38
hash3e7478d3854eaeed487230ba9299c87d5a5d70e4fbeac841555327c76b7b405e
hash42c3b9cad6c8383699eba4f82d51908c0d61e9ea454bc40447cf20475ce20ff0
hash44cfba85aa27265779b01f6eb8b69718462b1ca8078b21066061e8d1622dff7a
hash45d8d4f04eb44dc5d10290038825194b0ffc38048a786b4a8b81bb796afc58a3
hash46314092c8d00ab93cbbdc824b9fc39dec9303169163b9625bae3b1717d70ebc
hash4d528842c7fe73681dfe569d38a39f8d38ca5548dbc8b6ac02df096713a92efd
hash4ed76fa68ef9e1a7705a849d47b3d9dcdf969e332bd5bcb68138579c288a16d3
hash50746ddd81a5dbc5cec793209ab552125fff9c7184aa5bcfe22d6c3b267f67f1
hash53086e3b557a1d21cf7f4ffc73d92c39b08872334a8cdb09dda0a06bd060cfe9
hash56f0247049be8b9dc1da7c55957d2fb4f7177965ba62789c512f3e2b4c0c5c26
hash5c3208c5217933e16c5119e7baf78f85fd409e8822d1cd7a8ef2d52a5bd511c1
hash64bae6a215ad9e956d1028603438228003d832bdd5e586ad4988f5c7ad1c54f0
hash6788365386ccd34d1db681c61ef07ef4d2faea5672571b77a76dc48f327afaa9
hash69b685fadce4f34bc4964b3d78d43694a428ae1ee4d2fe0ce4ed26fad07847fa
hash6b363e0f16fc5a612bd98631e7cdc4f68a95329e92c21ef0495c9117b8b8f360
hash774841a2bfb07b61a8be3de8ae31e9847f987de652eef179761dc3d1b34c42ff
hash784a914bd1878ad68a6cf3f693da5ddcc2f04b794204333098ad749b7e372fd4
hash795ad4789a185c3abc35b3ad82117db6b60a7b8ab857e41080873f070d4a06f0
hash79e0ab17e761a00ad12b9848f1f07b507f57db532fa2df8c722693e14feb17c3
hash7be77e6166aae9a89b16b64b593f35afc7424926047635f2230a4e364c6a46d8
hash7c96d08f5ce46d1a857184490a7e68ca2b02e9cbe9d188742f184f21bc9c62d9
hash7d2b6c48cbd6cef05ea2bdae7dfc001504cccda99dd89eb7fe6646e96c1d5515
hash8421e7995778faf1f2a902fb2c51d85ae39481f443b7b3186068d5c33c472d99
hash843b22df66f87a587be77145da163f9615fe8164a5ea17f9e33562ff43894fbf
hash84d6a8b47edadf5725d9937d8928a90d190e0c98b5b4d1a4c58e97cddcd36768
hash87929c8f53341a5e413950d33c7946c64e1d4b2eba6d1a8b2d08ef56f7065052
hash8c0051a83b3611ff2b669b670aa005633f3d9e844454a112b31d2a4bc944a234
hash93e9402af72b355554f9ba93c64871b1bae5be498e3b8a10e61ebdd10ab0d050
hash965894996e2cb9be1e0ccc509e079e7eca072cbc4e68945beb00ff5979dda19c
hash9d61c4e21bbbddde5bb780ea0c5238a3538a84b9afe98d62d08845b47fb5caa9
hash9e67f72bfbc8772ce10633430e1277fd8374e99877ddedb598b4f6717c799eeb
hasha3f9e20315663e4e8feb13e77563e3cb0f2f4844734987e51e14bd172b9a04fd
hasha82c8845587a87010eab52ef8c35d45eaea8eb8102aae77ec96e222197b7db66
hasha95e3857e2f32c2a9c23accadebc1ad6aabf73fed9d63c792d69122d9ec6726d
hashae8d2cef8eac099f892e37cc50825d329459baa9625b71fb6f4b7e8f33c6ccce
hashb1606ca49aa15eadb039f33d438697973b203693d0003e467e1f33b36d10a530
hashb394e7a3b350b2104b73e29a04e48e5ede5078b9a811abae58d842ce3442c6b3
hashb6d866054dedf7a882dd1fa405a066de1278e35acf639b3a0e850a637d27c4bc
hashbc8b022c10bcab39da302446b0a50988de94607c7e724f2051578e8ed2f8bbe7
hashbcd30f2116f5ba6731c628483d597b2ba3620ed464c63875855906306beb102a
hashc5267fefaac1764eba5f42681eb216f146b7d18fcbf546275d33e70cb36fdfba
hashc73050860c8aaa0f79c03781519cdcee133832805e2e3e778fef3cb0e917efb1
hashc8a6302adf92353556c600a0afa9146fbc04663fffe8be90808df2bf04ec5703
hashc96338533d0ab4de8201ce1f793e9ea18d30c6179daf1e312e0f01aff8f50415
hashd0576b39bb6c05ea0a24d3a3d5d7cb234454fefc65860f21a97757582adc7650
hashde13e4b4368fbe8030622f747aed107d5f6c5fec6e11c31060821a12ed2d6ccd
hashde8ddc2451fb1305d76ab20661725d11c77625aeeaa1447faf3fbf56706c87f1
hashe036e2ba402d808adbb7982ec8d7a207849ff40456633b2b372bc7916d9dc22f
hashe1e597852d684bd6d0395d5094e58831f13635f668e7cf66ba71b8b66be0ce6c
hashe31eafb49dbcad079ff177703b5a033f3e0365991cf28492339eccfe0fdf812c
hashe79d19d68d307c12413f8549aafa4a56776002dd04601e36e0125b2e6d56ff94
hashe7ed0cd4115f3ff35c38d36cc50c6a13eba2d845554439a36108789cd1e05b17
hashe9d8f28fd0aef3bc3f5b28a41b3f342165b371db9aefd7d03f2aba4292009d3e
hasheb10443a2f0b9a25d01a84426a6a8532b0e7c9157abda55b94c98a1fd2d45562
hashf333bc5238e39790fb7560de067a852e9a99df2bb783cf08738d8a0d424b9658
hashf988d58e4a32b908ff7a557d740c6860c59807832c7626774330dcaed65ead14

Url

ValueDescriptionCopy
urlhttp://ombut.com:443
urlhttps://dash.ghonline.net:443/download/jyebbtg?error=interaction_required&error_description=Session+information+is+not+sufficient+for+single-sign-on.&state=o1
urlhttps://phpthemes.net/images/upload/
urlhttps://phpthemes.net/images/upload/eu.png/
urlhttps://web.florarevival.com:443/download/a6d6u9ff13?error=interaction_required&error_description=session+information+is+not+sufficient+for+single-sign-on.&state=6
urlhttps://welnetsanda.org/images/upload/logo.png/
urlhttps://www.buscacnpj.org/download/we7823bn?error=interaction_required&error_description=session+information+is+not+sufficient+for+single-sign-on.&state=3
urlhttps://www.bushidomma.net/download/l7o9afe?error=interaction_required&error_description=session+information+is+not+sufficient+for+single-sign-on.&state=2
urlhttps://www.foxmediagency.com/download/qqa36sa0d6fq066?error=interaction_required&error_description=Session+information+is+not+sufficient+for+single-sign-on.&state=o1
urlhttps://www.subusiness.org/download/aetce17ge?error=interaction_required&error_description=session+information+is+not+sufficient+for+single-sign-on.&state=47

Domain

ValueDescriptionCopy
domainaaitile.com
domainadimagemarketing.com
domainalpinemfg.net
domainamblecote.net
domainanbusivam.com
domainatravelingwitch.com
domainbasecampbox.com
domainbobbush.org
domainbuddhismnewsdaily.org
domainbuscacnpj.org
domainbushidomma.net
domainbusopps.org
domainbuywownow.com
domainbuzzurro.net
domaincarhirechicago.com
domaincnrelojes.com
domaincoastallasercompany.com
domaincolorflee.org
domaincreatday.com
domaincseconline.org
domaincubukluescort.com
domaindalerocks.com
domaindecoraat.net
domaindesignehair.com
domaindevlyrics.com
domaindevredin.com
domaindnzapping.com
domaindoorforum.com
domainecoafrique.net
domainecolnomy.com
domainecomputers.org
domainembwishes.com
domainespacebus.com
domainfamisu.com
domainflorarevival.com
domainfoxmediagency.com
domainfruitbrat.com
domainfuyuju.com
domaingesecole.net
domaingestationsdiabetes.com
domainghonline.net
domaingoodmedsx.com
domaingynecocuk.net
domainharrietmwelch.com
domainhayabusamt.com
domainhnk-capljina.com
domainhoplitellc.com
domainit-evenement.nl
domainloumuenz.com
domainmajicbus.org
domainmeritsoftwebportals.com
domainmettayoga.org
domainmongolianews.info
domainnapasbdc.org
domainnvofficespace.com
domainombut.com
domainpapermoonweddings.com
domainpaquimetro.net
domainphbusiness.net
domainphpthemes.net
domainportabalbufe.com
domainpremegalithic.com
domainracineupci.org
domainrhonline.net
domainrondabusco.com
domainronnybush.net
domainshalomrav.org
domainsofthunts.com
domainspeedifynews.com
domainstuypa.org
domainsubusiness.org
domainsupplementsoftheyear.com
domainthecamco.net
domaintheprmummy.com
domainturileco.net
domainwelnetsanda.org
domainwinesnmore.net
domainytsonline.net
domaindash.ghonline.net
domainepc.copenhagen2025.dm
domainweb.florarevival.com
domainwww.buscacnpj.org
domainwww.bushidomma.net
domainwww.foxmediagency.com
domainwww.subusiness.org

Threat ID: 69d4e778aaed68159a0e93d0

Added to database: 4/7/2026, 11:16:08 AM

Last enriched: 4/7/2026, 11:31:22 AM

Last updated: 4/8/2026, 12:43:44 AM

Views: 20

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Actions

PRO

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Please log in to the Console to use AI analysis features.

External Links

Need more coverage?

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now
OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited
View courses