MUSTANG_PANDA__2022__The_Good_the_Bad_and_the_Web_Bug_TA416_Increases_Operational_Tempo_Against_European_Governments_as_Conflict_in_Ukraine_Escalates_Proofpoint_US.pdf

Proofpoint documents a multi-year, active campaign by TA416 targeting European diplomatic entities and refugee/migrant services using web-bug reconnaissance to identify engaged recipients before delivering PlugX (Trident Loader) malware via malicious URLs and ZIP droppers; the report details updated PlugX obfuscation and configuration changes, command-and-control behavior, and provides extensive IOCs (IPs, domains, filenames, and hashes) for detection and response.