Loading story…
China-linked threat activity was reported against both critical infrastructure in India and diplomatic targets in Europe, with researchers describing sustained espionage and pre-positioning operations rather than confirmed destructive attacks. Recorded Future’s Insikt Group said intrusions hit seven Indian State Load Dispatch Centers near the disputed Ladakh border, as well as India’s national emergency response apparatus and an Indian logistics subsidiary, using ShadowPad malware, compromised DVR/IP camera devices for command-and-control, and the FastReverseProxy tool. The activity was assessed as likely intended to establish access and collect intelligence inside India’s power sector.
Separately, Proofpoint said China-aligned actor TA416 increased operations against European diplomatic entities as Russia-Ukraine tensions escalated, including targeting a person involved in refugee and migrant services. The campaigns used web bugs to confirm active recipients before sending malicious links that ultimately deployed updated PlugX malware through ZIP archives, droppers, and DLL search-order hijacking. Proofpoint found substantial overlap between TA416 and the publicly reported Red Delta cluster, while Beijing publicly denied involvement in the India-related accusations and said it opposes cyberattacks.
TTPs, infrastructure, and targeting history in one profile.
8 events from the most recent confirmed update back to the earliest known activity.
In late March 2022, SentinelLabs concluded that malware distributed in Ukraine and disguised as a request for video documentation of Russian aggression was associated with the suspected Chinese threat actor Scarab. The activity was described as one of the first public examples of a Chinese threat actor targeting Ukraine since the invasion began.
On February 28, 2022, TA416 used a compromised email account belonging to a diplomat from a European NATO country to target another country's diplomatic offices. The campaign delivered a compressed archive that fetched a decoy document, a legitimate executable, a malicious loader, and an encrypted PlugX payload.
Beginning on January 17, 2022, TA416 used a previously observed actor-controlled IP in phishing emails to deliver malicious ZIP files to European diplomatic entities that had earlier received web bug emails. The lures used geopolitical themes and led to a PlugX infection chain using a PE dropper and DLL search order hijacking.
Proofpoint observed TA416 using web bug reconnaissance campaigns against European diplomatic entities starting in early November 2021. The tracking pixels were used to confirm valid email accounts and whether recipients opened phishing emails.
In August 2020, TA416 impersonated UN personnel and targeted governmental entities in Europe using a Dropbox URL to deliver a PlugX variant. Proofpoint said this activity aligned with Recorded Future's publicly reported Red Delta analysis.
China denied involvement in the reported attacks on India's power grid. Foreign ministry spokesperson Zhao Lijian said Beijing opposes cyberattacks and urged caution in attributing such activity to governments.
Insikt Group reported network intrusions affecting seven Indian State Load Dispatch Centers near the disputed Ladakh border, along with an Indian national emergency response team and the Indian subsidiary of a logistics company. The operation used ShadowPad and FastReverseProxy, and was assessed as likely pre-positioning and intelligence collection against critical infrastructure.
Proofpoint reported ongoing China-aligned TA416 espionage targeting European diplomatic entities and at least one individual involved in refugee and migrant services. The company said the activity aligned with Chinese interest in refugee policies and logistics during the Russia-Ukraine conflict period.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 55 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A China-linked intrusion set tracked as **RedEcho** targeted India’s power sector and other critical infrastructure, with activity beginning in early 2020 and intensifying from mid-2020. Recorded Future observed Indian power-sector entities communicating with infrastructure associated with **AXIOMATICASYMPTOTE** and **ShadowPad** command-and-control servers, indicating a sustained campaign against high-value operational targets. The activity affected **10 distinct Indian power organizations**, including **4 of India’s 5 Regional Load Despatch Centres**, and also extended to **two Indian seaports**. Researchers assessed the campaign as more consistent with **strategic pre-positioning** inside critical infrastructure than ordinary economic espionage, raising concern that the access could support signaling, influence operations, or future disruptive action amid India-China tensions; while the infrastructure and victimology overlapped with groups such as **APT41/Barium** and **Tonto Team**, the operation was tracked separately as **RedEcho** because attribution remained inconclusive.
Jun 30, 2026
Proofpoint reported that China-aligned threat actor **TA416** resumed sustained cyberespionage against European government, diplomatic, and NATO-linked targets from mid-2025, ending a lull in its EU-focused activity. The campaign heavily targeted diplomatic missions to the **EU** and **NATO**, with lures tied to geopolitical issues including EU-China trade tensions, the Russia-Ukraine war, rare earth exports, humanitarian concerns, interview requests, collaboration proposals, and claims about Europe sending troops to Greenland. Researchers said the actor used reconnaissance-focused web bugs and phishing emails to profile victims before attempting malware delivery. The intrusion chains evolved repeatedly but consistently aimed to install a customized **PlugX** backdoor via **DLL sideloading**. Proofpoint observed fake Cloudflare Turnstile pages, abuse of Microsoft Entra ID OAuth redirects, and renamed MSBuild binaries paired with malicious C# project files, alongside updates to TA416's PlugX loader, persistence mechanisms, command-and-control protocol, and configuration encryption. The group also relied on re-registered domains, Cloudflare CDN masking, and VPS infrastructure, and in March 2026 expanded targeting to Middle Eastern diplomatic and government entities after conflict erupted in Iran, indicating intelligence collection driven by fast-moving geopolitical developments.
Jun 29, 2026
Multiple reports and leaked documents indicate **China-linked cyber operations** are expanding in scale and sophistication, with a strong emphasis on targeting government, telecommunications, and other strategic sectors. A Forescout *Vedere Labs* analysis cited by Cybernews reported China as the top origin of threat operations last year (210), with Russia and Iran also major contributors; the reporting also highlighted suspected China-linked activity tied to a multi-year compromise of South Korea’s **Onnara System**, including theft of civil servants’ **GPKI certificates and credentials**, and noted Taiwan’s National Security Bureau reporting an average of **2.63 million attacks per day** last year. Separately, leaked technical materials reviewed by Recorded Future News describe a purported Chinese internal training environment—part of an integrated system called **“Expedition Cloud”**—used to rehearse offensive cyberattacks against replicas of neighboring countries’ real-world networks, including **power/energy transmission, transportation, and smart home infrastructure**. In parallel, a Google Threat Intelligence Group report warned of a “relentless barrage” of nation-state activity against the **U.S. defense industrial base**, describing a shift beyond classic espionage into **supply-chain attacks, workforce infiltration, and battlefield-adjacent operations**; Google attributed much of the activity to **Chinese, Russian, Iranian, and North Korean** actors and noted continued Russian targeting of organizations supporting Ukraine, including phishing, malware aimed at mobile battlefield-management apps, and attempts to access encrypted messaging platforms.
Jun 29, 2026