TAG-110

TAG-110, also tracked as UAC-0063, is a Russia-aligned cyber-espionage threat actor active since at least 2021. The group has been associated with sustained intelligence-collection operations against government, diplomatic, educational, and research organizations, with a strong concentration on Central Asia and Ukraine and additional activity affecting European diplomatic targets. CERT-UA has assessed with medium confidence that UAC-0063 overlaps with APT28, also known as BlueDelta or Fancy Bear, a threat cluster linked to Russia’s GRU, although public technical reporting has also noted that the evidence is not yet sufficient to conclusively confirm that relationship. TAG-110 is known for spear-phishing campaigns that weaponize legitimate or legitimate-looking government documents, including documents stolen from previously compromised victims, to infect new targets. The actor has used malicious Microsoft Word documents and macro-enabled Word templates to establish initial access and persistence. Earlier activity commonly delivered the HTA-based loader HATVIBE through VBA macros, while later campaigns in Tajikistan used macro-enabled template files that copied themselves into the Microsoft Word startup folder for automatic execution and command-and-control. Reporting also links the group to exploitation of CVE-2024-23692 in HFS HTTP File Server, indicating use of both phishing and public-facing application exploitation. The actor’s malware ecosystem includes HATVIBE, CHERRYSPY (also known as DownExPyer), DownEx, LOGPIE, STILLARCH, and PyPlunderPlug. HATVIBE functions as a loader and backdoor that establishes persistence and retrieves follow-on payloads. CHERRYSPY supports remote tasking including file theft, command execution, screenshot capture, and task management. PyPlunderPlug has been used to collect files from removable media for later exfiltration. LOGPIE-related activity and tasking indicate keylogging and retrieval of captured keystroke data. Across observed intrusions, TAG-110 has maintained persistence with scheduled tasks, used compromised email accounts to resend malicious lures from trusted correspondents, and deployed Python-based tooling after initial compromise. Victimology includes Ukrainian scientific and research institutions, Tajik government, educational, and research entities, government organizations in Kazakhstan and Afghanistan, and diplomatic missions or embassies in Germany, the United Kingdom, the Netherlands, Romania, Georgia, Kazakhstan, and Afghanistan. The group’s targeting and tradecraft are consistent with strategic espionage and intelligence-gathering objectives aligned with Russian geopolitical interests in Central Asia, Ukraine, and related diplomatic environments.