Threat actorcritical
Russia-Aligned TAG-70 Targets European Government and Military Mail Servers in New Espionage Campaign
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-23397 | Zero-Click Elevation of Privilege in Microsoft Outlook (Forced NTLM Credential Leak) | 9.8 | 97% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | bugiplaysec.com | ictim IP address was observed communicating with the domain bugiplaysec[.]com over TCP port 443, which at the time resolved to IP addre |
| domain | hitsbitsx.com | ce: Recorded Future) On July 27, 2023, a new TAG-70 domain, hitsbitsx[.]com, resolved to IP address 176.97.66[.]57. Insikt Group also |
| domain | mail.mod.gov.ge | tors were targeting the Georgian Ministry of Defence domain mail[.]mod[.]gov[.]ge. The structure of this payload overlaps with the one |
| domain | ocsp-reloads.com | Uzbekistan in Ukraine and a previously reported C2 domain, ocsp-reloads[.]com, which resolved to IP address 38.180.2[.]23. This additio |
| ipv4 | 198.50.170.72 | then likely relayed to command and control (C2) IP address 198.50.170[.]72 on TCP port 7662. It is suspected that TAG-70 administere |
| ipv4 | 86.105.18.113 | onal C2 likely forwarded the data it received to IP address 86.105.18[.]113 on TCP port 1194 and TAG-70 likely connected to the C2 vi |
| sha256 | 6800357ec3092c56aab17720897c29bb389f70cb49223b289ea5365314199a26 | ied a related JavaScript sample from November 2022 (SHA256: 6800357ec3092c56aab17720897c29bb389f70cb49223b289ea5365314199a26). This older sample was hosted on the domain bugiplaysec[.] |
| sha256 | ea22b3e9ecdfd06fae74483deb9ef0245aefdc72f99120ae6525c0eaf37de32e | ed malware sample uploaded to a malware repository (SHA256: ea22b3e9ecdfd06fae74483deb9ef0245aefdc72f99120ae6525c0eaf37de32e). The discovered JavaScript malware matches the second-stag |
From the original article
4 min read at recordedfuture.com
Recorded Future’s Insikt Group has identified TAG-70, a threat actor likely operating on behalf of Belarus and Russia, conducting cyber-espionage against government, military, and national infrastructure entities in Europe and Central Asia since at least December 2020. TAG-70 overlaps with activity reported by other security vendors under the aliases Winter Vivern, TA473, and UAC-0114.
By Insikt Group® · recordedfuture.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.