TAG-124
Aliases: LandUpdate808
- Primary motivation
- financial-gain
- Sophistication
- advanced
- Resource level
- organization
- Actor type
- criminal
- Last IoC activity
- 2026-07-21 08:37:57
- Profile updated
- 2026-07-07 12:21:39
Targeted industries: professional-services government-and-public-sector technology-and-telecommunications
Targeted regions: country_code:pl country_code:gh country_code:ng
Context
TAG-124 is a threat actor that employs a traffic distribution system to distribute malware, primarily using MintsLoader and targeting various sectors through phishing emails and compromised websites. The actor injects malicious JavaScript into WordPress sites, leading victims to fake Google Chrome update landing pages that facilitate malware downloads, often masquerading as legitimate updates. TAG-124 has been linked to multiple ransomware groups, including Rhysida and Interlock, and demonstrates high activity levels by regularly updating its infrastructure and refining its infection tactics, such as the ClickFix technique. Notable compromised sites include those associated with the Polish Centre for Testing and Certification and the Economic Community of West African States (ECOWAS).
Reports & references
- recordedfuture.com — Uncovering Mintsloader With Recorded Future Malware Intelligence Hunting (report)
- recordedfuture.com — Tag 124 Multi Layered Tds Infrastructure Extensive User Base (report)