Key points
- TAG-193 targets government entities in Russia, Tajikistan, Belarus, Armenia, and Uzbekistan.
- The group uses compromised official accounts to send spearphishing emails with diplomatic lures.
- Malicious scripts are hosted on public platforms like GitHub to blend into workflows.
TAG-193 conducts cyber-espionage operations against government institutions responsible for diplomacy, economic development, agriculture, and environmental management. According to joint research by Cisco Talos and Recorded Future, these organizations hold data that informs regional security decisions and economic planning. The group’s activities span Central Asia and the wider Commonwealth of Independent States, where shared infrastructure gives this information strategic value.
The study examined campaigns from early 2025 through May 2026. Researchers identified activity involving entities in Russia, Tajikistan, Belarus, Armenia, and Uzbekistan. Lure documents and impersonated services indicated broader targeting interests. These findings suggest a sustained intelligence-collection mission focusing on diplomatic priorities and natural resource management, rather than random opportunistic attacks.
What we know
Intrusions identified through Recorded Future Network Intelligence occurred around diplomatic developments involving Kazakhstan. Communications were noted between a Tajik government entity and TAG-193 infrastructure following parliamentary consideration of a treaty with Tajikistan. Activity involving a Belarusian agriculture entity preceded a senior bilateral meeting in Astana. These temporal associations provide context for the group’s interests, though they do not establish direct connections to the events or reveal what information was sought.
TAG-193 shows recurring interest in environmental and resource-management institutions. Observed activity involved an Armenian entity responsible for environmental matters and infrastructure linked to Uzbekistan’s Smart Forestry initiative. Additional targeting focused on Nizhny Novgorod, Russia, located at the confluence of the Volga and Oka rivers. Earlier reporting linked the group to water-resource organizations, providing context for this geographic focus.
The group frequently sends spearphishing emails from compromised government accounts to make communications appear credible. Identified lures included a diplomatic letter to Armenia’s Ministry of Foreign Affairs, a Turkmenistan airspace application, and a business proposal for Russia’s Orsk Oil Refinery. These documents indicate targeting interests but do not independently prove successful compromises of the referenced organizations.
Operational security lapses on TAG-193 infrastructure revealed exposed directories containing additional malware and a previously undocumented GitHub staging account. Researchers used these errors to connect campaigns and trace changes in the group’s tooling. The group also hosts malicious scripts on public services like GitHub to help content blend into routine workflows.
Defender's checklist
- Verify the authenticity of emails claiming to originate from government or diplomatic accounts.
- Monitor for unusual access to directories containing sensitive environmental or diplomatic data.
- Inspect links and scripts hosted on public code repositories before execution.
- Check for connections to infrastructure associated with known espionage campaigns.
What analysts watch for
Teams usually examine spearphishing emails for subtle deviations in sender domains or digital signatures. Analysts check whether attachments mimic official diplomatic or administrative forms. They look for persistence mechanisms that leverage trusted hosting services to deliver payloads. Investigators also review network logs for communication with compromised government accounts. Monitoring for exposed directories on internal servers helps identify operational security failures. Teams verify that scripts fetched from public repositories match expected hashes.
What to do and how to stay safe: TAG-193
- Train staff to recognize spearphishing attempts using official-looking documents from government sources.
- Implement strict validation for emails received from compromised or high-value accounts.
- Monitor network traffic for connections to known malicious infrastructure or staging accounts.
- Review access controls for directories containing sensitive diplomatic or resource management data.
Step-by-step guide: Threat Hunting Explained: Proactive Security Beyond Alerts
General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which countries are targeted by TAG-193?
The group targets government entities in Russia, Tajikistan, Belarus, Armenia, and Uzbekistan.
How does TAG-193 deliver its malware?
The group uses spearphishing emails from compromised accounts and hosts scripts on public services like GitHub.
What sectors does TAG-193 focus on?
The group focuses on diplomacy, economic development, agriculture, and environmental management.
