China-Linked TA416 Targets European Governments with PlugX and OAuth-Based Phishing

This article covers TA416, a China-aligned threat actor, resuming targeted campaigns against European government and diplomatic entities since mid-2025 using PlugX malware and OAuth-based phishing techniques.

• •TA416 overlaps with multiple tracked clusters including DarkPeony, RedDelta, and Mustang Panda, and uses DLL side-loading as a common delivery mechanism
• •Attack chains evolved over time: from Cloudflare Turnstile abuse and OAuth redirect phishing via Microsoft Entra ID to MSBuild-based C# project file execution
• •PlugX is delivered via malicious archives hosted on Azure Blob Storage, Google Drive, and compromised SharePoint instances
• •The backdoor supports five commands including system info capture, reverse shell, payload download, and malware uninstall, with encrypted C2 communication