Proofpoint Threat Research Team reports that China-aligned TA416 resumed targeting European government and diplomatic organizations from mid-2025. They also observed a March 2026 expansion into Middle Eastern diplomatic and government entities, alongside evolving PlugX delivery chains. https://www.proofpoint.com/us/blog/threat-insight/id-come-running-back-eu-again-ta416-resumes-european-government-espionage