Russian cybercriminals, known as TAG-110, are engaged in a sophisticated cyber espionage initiative aimed at various organizations across Central Asia, East Asia, and Europe. This group has been operational since at least 2021 and is associated with APT28, a notorious cyber threat entity. Their primary targets include governmental bodies, human rights organizations, and educational institutions, indicating a strategic focus on sectors that are vital for information and influence.

To execute their operations, TAG-110 employs two specialized malware tools: HATVIBE and CHERRYSPY. HATVIBE functions as a loader that activates CHERRYSPY, a backdoor developed in Python, specifically designed for data theft and espionage activities. The first recorded deployment of these tools took place in May 2023 during an assault on Ukrainian state agencies, with further attacks noted against a scientific research institution in Ukraine.

Since the onset of their campaign, TAG-110 has compromised 62 distinct targets across eleven nations, with a notable emphasis on Central Asian countries such as Tajikistan, Kyrgyzstan, Kazakhstan, Turkmenistan, and Uzbekistan. This targeted approach suggests a concerted effort to collect intelligence that aligns with Russia’s strategic interests in the region. Additional targets have been identified in Armenia, China, Hungary, India, Greece, and Ukraine.

The tactics employed by TAG-110 include exploiting vulnerabilities in publicly accessible web applications and utilizing phishing emails to establish initial access. This methodology enables them to deploy HATVIBE, which subsequently allows for the installation of the CHERRYSPY backdoor to facilitate data extraction.

In summary, the activities of TAG-110 seem to be part of a larger Russian strategy aimed at bolstering intelligence operations concerning geopolitical shifts and sustaining influence in post-Soviet territories, particularly in the context of heightened tensions following Russia’s invasion of Ukraine. Furthermore, there are signs that Russia has escalated its sabotage efforts against critical infrastructure in Europe, specifically targeting NATO allies to undermine their support for Ukraine.

#CyberEspionage #TAG110 #APT28 #CyberThreat #Malware #DataTheft #HATVIBE #CHERRYSPY #CentralAsia #EastAsia #Europe #CyberSecurity #IntelligenceOperations #GeopoliticalStrategy #Phishing #VulnerabilityExploitation #HumanRights #EducationalInstitutions #GovernmentalBodies #PostSovietInfluence