Russia-Aligned TAG-110 Evolves Spear-Phishing Tactics in Tajikistan

• Russia-aligned threat actor with links to UAC-0063 and APT28 improves tactics in targeting Tajikistan.
• TAG-110 displayed a tactical shift designed to increase persistence and evade current detection protocols.
• The current spear-phishing campaign adopts macro-enabled Word template files deployed in the Microsoft Word STARTUP directory.

An ongoing spear-phishing campaign was attributed to TAG-110, a Russia-aligned threat actor with links to UAC-0063 and APT28 (BlueDelta), which targeted Tajik government, educational, and research institutions with macro-enabled Word documents.

The campaign occurred between January and February 2025, TAG-110 marking a tactical shift designed to increase persistence and evade current detection protocols, a recent report by Insikt Group details.

Historically, TAG-110 leveraged trojanized legitimate documents embedded with HATVIBE, an HTA-based payload. The current spear-phishing campaign, however, adopts macro-enabled Word template files (.dotm), which are deployed in the Microsoft Word STARTUP directory. 

This tactic ensures the malicious macro executes automatically whenever Word launches, cementing persistence and complicating mitigation.

The malicious documents were themed around Tajik governmental notifications and electoral schedules and carried VBA macros that perform several key functions.

These included copying themselves to the Word STARTUP folder for automatic execution as a global template and collecting system information, such as computer name, region, and user credentials.

The malware could establish command-and-control (C2) communication with the IP 38.180.206[.]61, previously associated with HATVIBE campaigns, and download and execute additional payloads based on remote C2 instructions, potentially facilitating broader espionage objectives.

TAG-110’s operations support Russia’s objective to maintain influence across Central Asia through intelligence collection. The targeting of entities involved in sensitive events, such as elections, is likely to continue, according to Insikt Group. 

The group’s evolving technique—from HTA payloads to persistent .dotm templates—not only demonstrates adaptability but also highlights the broader trend of increasing sophistication among state-aligned APT actors.