Russia-aligned hackers target Tajikistan in new espionage campaign

Hackers tied to Russia have launched a new cyber-espionage campaign targeting government, academic and research institutions in Tajikistan, researchers have found.

The campaign, observed in January and February, was attributed to a threat group known as TAG-110 by researchers from Recorded Future’s Insikt Group. The group is believed to be linked to the Russian military intelligence-backed outfit APT28, also known as BlueDelta. 

The Record is an editorially independent unit of Recorded Future. 

The hackers used phishing emails containing government-themed lure documents to gain access to targeted systems. The decoy files included a notice purportedly from Tajikistan’s armed forces referencing radiation safety, and an election schedule in Dushanbe, the country’s capital. The authenticity of the documents could not be independently verified.

The campaign reportedly marked a shift in tactics for TAG-110, which abandoned the previously used Hatvibe malware in favor of macro-enabled Word templates to initiate infection. If successful, researchers say the attackers likely deploy additional espionage tools such as Cherryspie, Logpie, or potentially new custom malware.

The group has carried out cyber-espionage operations in Central Asia since at least 2021, and has also targeted entities in India, Israel, Mongolia and Ukraine. Insikt Group analysts believe these efforts align with Moscow’s broader goal of maintaining strategic influence in the region, especially amid shifting regional dynamics and growing geopolitical tensions.