Threat actor activity continues to be on the rise as the battles in Ukraine rage on. RedDelta, also tracked as TA416, have been increasing their presence as a key threat group by targeting European diplomatic entities with PlugX malware variants. Historically, RedDelta has conducted cyber espionage activity for the benefit of the Chinese state, collecting intelligence from their victims and relaying it back through the proper channels. Delivery methods for this campaign are sophisticated phishing emails embedded with malicious URL’s, often times targeting officials assisting with refugee and migrant services out of Ukraine. The malicious URL upon execution will download a newly customized PlugX malware payload from a command-and-control node, allowing threat actors to establish system persistence while also remaining very difficult to detect. From here the threat actor can harvest any range of information from the compromised device such as system information, geolocation data, credentials, and so on. CTIX analysts continue to track threat actors worldwide and will provide additional insight accordingly.