Storm-2077
Aliases: TAG-100, RedNovember
- Origin
- CN
- Primary motivation
- espionage
- Sophistication
- advanced
- Resource level
- government
- Actor type
- nation-state
- Profile updated
- 2026-07-07 12:19:23
Targeted industries: education-and-nonprofits financial-services government-and-public-sector
Context
TAG-100 is a cyber-espionage APT that targets government and private sector organizations globally, exploiting vulnerabilities in internet-facing devices such as Citrix NetScaler and F5 BIG-IP for initial access. The group employs open-source tools like Pantegana and SparkRAT for persistence and post-exploitation activities, including credential theft and email data exfiltration. TAG-100 has compromised entities in at least ten countries, including two Asia-Pacific intergovernmental organizations, and focuses on sectors like education, finance, and local government. Their operations highlight the challenges of attribution due to the use of off-the-shelf tools and techniques that overlap with other state-sponsored groups.
Reports & references
- Microsoft — Microsoft Shares Latest Intelligence On North Korean And Chinese Threat Actors At Cyberwarcon (report)
- recordedfuture.com — Tag 100 Uses Open Source Tools In Suspected Global Espionage Campaign (report)
- thehackernews.com — Chinese Hackers Rednovember Target (report)
- raw.githubusercontent.com — Microsoftmapping (report)