Cybersecurity researchers from Insikt Group identified a sophisticated phishing campaign targeting entities in Tajikistan.
The campaign is attributed to TAG-110, a Russia-aligned cyber espionage group that overlaps with the threat cluster UAC-0063 and has been linked to APT28 (BlueDelta) by CERT-UA with medium confidence.
This operation marks a notable change in TAG-110’s tactics, shifting from the deployment of traditional HTA-based malware (HATVIBE) to the use of malicious macro-enabled Word template files (.dotm) as the primary initial access vector.
Technical Analysis
TAG-110’s recent activities involved sending spearphishing emails using Tajikistan government-themed documents as lures.
These documents, unique to this campaign, lack the previously observed embedded HTA payloads and instead utilize .dotm files.
Analysis of these files revealed custom Visual Basic for Applications (VBA) macros designed for persistence by copying themselves to the Microsoft Word STARTUP directory.
Once installed, these global templates ensure that malicious macros execute automatically each time Microsoft Word is launched, significantly increasing the potential for long-term access.
The technical functionality of the malicious documents is extensive. Upon opening, the macro unprotects the file, hides spelling errors, and attempts system configuration changes.
Critically, it creates a persistent foothold by copying itself to %APPDATA%\Microsoft\Word\STARTUP\<filename>.dotm, ensuring continual execution.
The macros collect detailed system information including hostnames, usernames, region, display resolution, system language, and OS version and transmit this data via HTTP POST requests to a hardcoded C2 server.
The samples communicate with the C2 at 38.180.206[.]61, a server previously associated with other TAG-110 operations.
Notably, the macro incorporates anti-analysis and evasion tactics, such as logic that delays information exfiltration based on the time since Word was last launched, and triggers the execution of additional VBA code supplied dynamically through the C2 channel.
According to Recorded Future Report, this enables the attackers to deploy second-stage payloads or update existing malware functionality in real time.
Geopolitical Context
TAG-110 continues to align its cyber-espionage activities with Russian strategic objectives in Central Asia.
The group has a documented history of targeting government, research, and educational institutions in the region, aiming to gather intelligence and influence political developments, especially around sensitive events like elections.
The most recent campaign’s use of government-themed and election-related lure materials suggest attempts to infiltrate key state and civic infrastructure.
Both analyzed documents, with SHA256 hashes d60e54854f2b28c2ce197f8a3b37440dfa8dea18ce7939a356f5503ece9e5eb7 and 8508003c5aafdf89749d0abbfb9f5deb6d7b615f604bbb11b8702ddba2e365e7, demonstrate code reuse, infrastructure overlap, and targeting patterns consistent with previous TAG-110 operations.
The persistent use of custom malware families such as CHERRYSPY (DownExPyer), LOGPIE, and PyPlunderPlug further underscores the group’s evolution and ongoing threat to Central Asian digital assets.
Security teams are urged to monitor the Word STARTUP directory for unauthorized or suspicious global templates and to enforce strict policies on macro execution within Office applications.
Investigating unusual modifications to registry keys related to VBA macro security (e.g., AccessVBOM) is also recommended.
Integrating threat intelligence feeds and monitoring for emerging TAG-110 indicators in SIEM or SOAR platforms will bolster defense against these advanced threats.
Indicators of Compromise (IOC)
| Type | Value |
|---|---|
| IP Address | 38.180.206[.]61 |
| IP Address | 188.130.234[.]189 |
| SHA256 Hash | d60e54854f2b28c2ce197f8a3b37440dfa8dea18ce7939a356f5503ece9e5eb7 |
| SHA256 Hash | 8508003c5aafdf89749d0abbfb9f5deb6d7b615f604bbb11b8702ddba2e365e7 |
| SHA256 Hash | 6c81d2af950e958f4872d3ced470d9f70b7d73bc0b92c20a34ce8bf75d551609 |
| C2 URL | http://38.180.206[.]61:80/engine.php |
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.
