A China-linked cyberespionage group attributed by Proofpoint researchers, tracked as TA416 (also known as Mustang Panda, Twill Typhoon, RedDelta/SmugX), has refocused on European and Middle Eastern diplomatic targets since mid-2025, after two (2) years prioritizing Southeast Asia, Taiwan, and Mongolia. The Proofpoint researchers point out that the renewed activity closely tracks geopolitical flashpoints: heightened EU–China tensions over trade, the Russia–Ukraine war, rare earths, and, from March 2026, the Iran conflict. TA416’s primary targets are mailboxes tied to EU and NATO delegations and other diplomatic missions, later expanding to Middle Eastern government and embassy networks. Initial waves used “humanitarian concerns,” interview requests, collaboration proposals, and a Greenland troop-deployment article as lures, first for web-bug reconnaissance (tracking who opens emails) and then for malware delivery. Across late 2025–early 2026, the group repeatedly changed its initial infection chains while keeping the same objective: deploying a customized PlugX backdoor via DLL sideloading. Techniques included: Fake Cloudflare Turnstile pages impersonating Microsoft logins, leading to ZIP-smuggled LNK payloads; Abuse of Microsoft Entra ID OAuth redirects from legitimate Microsoft URLs to attacker download sites; and archives on Google Drive/compromised SharePoint containing a renamed MSBuild executable and malicious C# project files that fetch PlugX loaders. Recent PlugX variants add stronger evasion (API hashing, junk code, control-flow flattening), persistence via Run keys, and RC4-encrypted HTTP command-and-control (C2) with evolving protocols and config obfuscation. TA416 heavily uses re-registered legitimate domains, Cloudflare CDN, and VPS providers to evade reputation-based defenses. Overall, TA416 appears to be running long-term intelligence-gathering campaigns against EU/NATO and now Middle Eastern diplomatic entities, aligned with national strategic interests.