TAG-124’s Multi-Layered TDS Infrastructure and Extensive User Base
By Insikt Group®
Excerpt
The operators behind TAG-124 show
high levels of activity, frequently
updating compromised WordPress sites,
setting up new servers, and refining
TDS-related conditional logic and
infection techniques.
Numerous threat actors have
relied on or continue to use
TAG-124, including the operators
of Rhysida and Interlock ransomware,
as well as several other high-profile
threat groups.
CYBER
THREAT
ANALYSIS
C…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Recorded Future on go.recordedfuture.com.
Mentioned in the excerpt
More from Recorded Future21
- BlueDelta Targets Defense and Diplomacy with HOOKEDGERecorded Future · Added 23 Sep
- Latin America and the Caribbean Cybercrime LandscapeRecorded Future · Added 4 Jun
- GrayCharlie Hijacks Law Firm Sites in Suspected Supply-Chain AttackRecorded Future · Added 17 Apr
- DRAT V2: Updated DRAT Emerges in TAG-140’s ArsenalRecorded Future · Added 17 Aug 2025
On the same topics
- Etude de cas : Comment Hunters International et ses affiliés ciblentSynacktiv · Added 25 Oct
- Inside Trickbot, Russia’s Notorious Ransomware GangWIRED · Published 1 Feb 2022
- darkraas-ransomware-intelligence-datacyberpress.org · Added 19 Oct
- Ragnar LoaderPRODAFT · Added 18 Oct
