The spy who logged me in.

The spy who logged me in.

From Research Saturday by N2K Networks

May 9, 2026 · 24 min · Season 10 · Episode 424

About this episode

Mark Kelly discusses the resurgence of espionage campaigns by the China-linked threat group TA416 targeting European governments and diplomatic missions.

Mark Kelly, Staff Threat Researcher at Proofpoint, is discussing their work on "I’d come running back to EU again: TA416 resumes European government espionage campaigns." China-linked threat group TA416 has resumed large-scale phishing and malware campaigns targeting European governments, diplomatic missions tied to the EU and NATO, and more recently Middle Eastern entities following the outbreak of conflict in Iran. The group has continually evolved its tactics between mid-2025 and early 2026, using techniques like fake Cloudflare verification pages, Microsoft OAuth redirect abuse, and malicious C# project files to deliver customized PlugX malware through spearphishing campaigns. Researchers say the renewed activity reflects shifting geopolitical priorities tied to EU-China tensions, the Russia-Ukraine war, and instability in the Middle East, while highlighting TA416’s ongoing focus on intelligence gathering against diplomatic networks. The research and executive brief can be found here: I’d come running back to EU again: TA416 resumes European government espionage campaigns Learn more about your ad choices. Visit megaphone.fm/adchoices

People in this episode

Guest: Mark Kelly

Topics covered

  • cybersecurity
  • espionage
  • phishing
  • malware
  • geopolitical tensions
  • intelligence gathering

Keywords

  • TA416
  • phishing campaigns
  • malware
  • PlugX
  • spearphishing
  • geopolitical priorities
  • Cloudflare
  • Microsoft OAuth

Mentioned in this episode

Organizations: Proofpoint, EU, NATO

Books & works: I’d come running back to EU again: TA416 resumes European government espionage campaigns

Places: Iran, Europe, Middle East

More episodes of Research Saturday

Explore listener stats, chart rankings, contacts and more on the Research Saturday podcast page.