TA416 has used SMTP2Go to impersonate various European diplomatic organizations since at least 2020. In this historical campaign, TA416 delivered a DropBox URL that delivered a PlugX variant aligning with Recorded Future’s analysis of "Red Delta" PlugX malware. Included below is a publicly available malicious Zip file hash from August 2020 delivered via a DropBox URL which is attributable to TA416/Red Delta