TAG-28

TAG-28 is a temporary designation for a China-linked, suspected state-sponsored activity cluster. The provided content attributes suspected intrusions against Indian organizations to TAG-28, including Bennett Coleman and Co. Ltd. (BCCL, "The Times Group"), the Unique Identification Authority of India (UIDAI), and the Madhya Pradesh Police department. The cluster is specifically described as using Winnti malware in a campaign targeting BCCL. Based on the content, TAG-28’s activity is assessed as primarily intelligence-driven: targeting UIDAI likely for access to the Aadhaar national identification database and associated bulk personally identifiable and biometric data, and targeting The Times Group likely to gain access to journalists, their sources, and potentially sensitive pre-publication reporting related to China or its leadership. The content states it is less likely that TAG-28 sought access to media entities in order to manipulate or disrupt publishing platforms. The reporting places TAG-28 within a broader pattern of suspected Chinese state-sponsored cyber operations targeting India. No additional aliases or sub-groups beyond the temporary designation TAG-28 are provided in the content.