TAG-28
- Origin
- CN
- Primary motivation
- espionage
- Sophistication
- advanced
- Resource level
- government
- Actor type
- nation-state
- Profile updated
- 2026-07-07 12:12:02
Targeted industries: media-and-entertainment government-and-public-sector
Targeted regions: country_code:in
Context
TAG-28 is a Chinese state-sponsored threat actor that has been targeting Indian organizations, including media conglomerates and government agencies. They have been using the Winnti malware, which is commonly shared among Chinese state-sponsored groups. TAG-28's main objective is to gather intelligence on Indian targets, potentially for espionage purposes.
Reports & references
- recordedfuture.com — China Linked Tag 28 Targets Indias The Times Group (report)