Chinese APT Group Returns to Target Catholic Church & Diplomatic Groups
APT group TA416 reemerges with new changes to its documented tool sets so it can continue launching espionage campaigns.
![](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc94608acf452fd67/655cf371ab171e040a838b2a/329050_DR23_Graphics_Website_V5_Default_Image_v1.png?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
Chinese advanced persistent threat (APT) group TA416, whose previous activity has been attributed to "Mustang Panda" and "RedDelta," has resumed attack activity following a brief hiatus, Proofpoint researchers report.
This recent wave of activity appears to be a continuation of previously reported campaigns that have targeted organizations linked to diplomatic relations between the Vatican and the Chinese Communist Party, as well as entities in Myanmar and groups conducting diplomacy in Africa.
The most recent period of activity spanned Sept. 16 through Oct. 10, 2020, a time that included a Chinese national holiday known as National Day and subsequent unofficial vacation period known as Golden Week. Attackers leveraged social engineering lures that referenced an agreement recently renewed between the Vatican Holy See and Chinese Communist Party. Researchers also detected spoofed email headers designed to appear as though they came from journalists reporting from the Union of Catholic Asia News.
Researchers have spotted updates to the actor's tool set, which they say is used to deliver PlugX malware payloads. More specifically, they detected a new Golang variant of TA416's PlugX malware loader and noticed the PlugX malware is consistently used in targeted campaigns. This signifies the group's persistence in changing its tool set to evade detection, researchers say.
"While baseline changes to their payloads do not greatly increase the difficulty of attributing TA416 campaigns, they do make automated detection and execution of malware components independent from the infection chain more challenging for researchers," they write.
Read the full Proofpoint blog post for more details.
About the Author
You May Also Like
State of AI in Cybersecurity: Beyond the Hype
October 30, 2024[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024