Threat actors associated with the RedDelta threat organization recently launched a new campaign targeting entities throughout Europe and Southeast Asia. Historically, RedDelta (also tracked commonly as Mustang Panda/TA416) has conducted numerous long term cyberespionage campaigns pertaining to Chinese government interests. These targets have included government entities, public sector operations, and overseas organizations associated with minority groups. In their recent campaign, initial infection from RedDelta actors originated from spear phishing emails containing a malicious attachment disguised as a Microsoft Word document were delivered to the targeted users. Generically, these documents were themed around government and migration policies within Europe. Threat actors utilized a double extension method for masking attachment integrity, simply by showing a “.doc.lnk” extension supported by a Microsoft Office icon next to the file download. Once all dependencies are established, the malicious code begins to decrypt the “PlugX” payload and mount it to the compromised system. After installation, PlugX maintains the capabilities to harvest keystroke data, upload/download/modify files, remote camera access, and full access to the Windows command line. RedDelta customized their version of PlugX malware to include advanced evasion/detection techniques to mask its illicit activity on the compromised system. CTIX continues to urge users to validate the integrity of all email correspondence prior to opening any attachments or visiting embedded links.