China-Linked TA416 Targets European Governments with PlugX and OAuth-Based Phishing

A China-aligned threat actor has set its sights on European government and diplomatic organizations since mid-2025,following a two-yearperiod of minimal targeting in theregion. The campaign has been attributedto TA416, a cluster of activity that overlaps with DarkPeony, RedDelta, Red Lich, SmugX, UNC6384, and VertigoPanda. "This TA416 activity included multiple