TA416

TA416 is an advanced persistent threat (APT) group that targets organizations globally with customized versions of the PlugX malware. TA416 has used a distinct installation method of a PE dropper to retrieve Trident loaded payload components using a legitimate PE and a DLL loader file to load a PlugX payload, which remains constant even though the components in this infection chain are regularly changing. This APT group has been known by several names such as Mustang Panda, Red Lich, Earth Preta, HoneyMyte, and Bronze President, Camaro Dragon, and LuminousMoth. In 2020, there were several espionage campaigns carried out by China's TA416 against Catholic Church and diplomatic groups, indicating a pattern of cyber espionage. Additionally, there have been other APTs with similar tactics, techniques, and procedures (TTPs), such as the Winter Vivern APT, which resurfaced after two years of hibernation. In late 2021, a Russian-aligned attacker took down the Vatican website in a suspected hacker attack. The discovery of a TA416 malware campaign during an investigation into an attack on a healthcare institution in Europe shed light on the activities of this APT group. The campaign involved the use of a Zip file with a geopolitically themed title shared with a PDF decoy that would later be downloaded as part of the infection chain. While this campaign's tactics are highly similar to the Trident Loader method used by TA416 in previous campaigns, the components in the infection chain regularly change.