MalwarePublished 22 May 2025Updated 21 Jun 2025

Targets Tajikistan: New Macro Word Documents Phishing Tactics

Source AlienVault OTX General

Description

From January to February 2025, a phishing campaign targeting Tajikistan was detected and attributed to TAG-110, a Russia-aligned threat actor. The campaign used Tajikistan government-themed documents as lures, shifting from previous tactics to macro-enabled Word template files for initial payload delivery. This change in approach demonstrates TAG-110's evolving tactics. The group's persistent targeting of Tajik government, educational, and research institutions aligns with Russia's strategy to maintain influence in Central Asia. The campaign likely aims to gather intelligence for influencing regional politics or security, particularly during sensitive events like elections or geopolitical tensions.

Impact

For European organizations, the direct impact of this campaign is limited given its primary focus on Tajikistan. However, the tactics employed by TAG-110 demonstrate an evolution in phishing methods that could be adopted against European targets, especially those with geopolitical or strategic ties to Central Asia or Russia. European entities involved in diplomatic relations, international research collaborations, or governmental affairs related to Central Asia may face increased risk of similar espionage attempts. The campaign underscores the persistent threat posed by Russia-aligned actors, who have historically targeted European institutions. The use of macro-enabled documents remains a common vector for initial compromise, and organizations with inadequate macro security policies or user training could be vulnerable. The intelligence gathering focus could lead to exposure of sensitive information, potentially affecting European organizations engaged in regional policy, security cooperation, or economic partnerships with Central Asian states. Additionally, the infrastructure and malware signatures identified could be repurposed or serve as indicators for detecting related campaigns targeting Europe, increasing the risk of lateral or expanded targeting.

Defensive guidance

To mitigate this threat and similar macro-based phishing campaigns, European organizations should implement targeted controls beyond generic advice: 1) Enforce strict Group Policy settings to disable macros by default in Microsoft Office applications, allowing macros only from trusted, digitally signed sources. 2) Deploy advanced email filtering solutions capable of detecting and quarantining macro-enabled documents, especially those masquerading as government or institutional communications. 3) Conduct focused user awareness training emphasizing the risks of enabling macros in unsolicited or unexpected documents, with simulated phishing exercises tailored to mimic such macro-enabled lures. 4) Utilize endpoint detection and response (EDR) tools configured to monitor and alert on suspicious macro execution and related process behaviors. 5) Maintain and regularly update threat intelligence feeds to incorporate indicators such as the provided file hashes and IP addresses, enabling proactive detection and blocking. 6) Establish incident response playbooks specifically addressing macro malware infections, including rapid isolation and forensic analysis. 7) For organizations collaborating with Central Asian partners, implement additional scrutiny on inbound communications referencing regional government themes. 8) Implement network segmentation and restrict outbound traffic to known safe destinations to limit command and control communications. These measures, combined with continuous monitoring and threat intelligence integration, will enhance resilience against evolving phishing tactics like those employed by TAG-110.

Indicators of compromise

IP addresses 2

188.130.234.189
38.180.206.61

Hashes 4

6ac6a0dd78d2e3f58e95fa1a20b3ab22b4b49a1ab816dcfb32fd6864e1969ac3
6c81d2af950e958f4872d3ced470d9f70b7d73bc0b92c20a34ce8bf75d551609
8508003c5aafdf89749d0abbfb9f5deb6d7b615f604bbb11b8702ddba2e365e7
d60e54854f2b28c2ce197f8a3b37440dfa8dea18ce7939a356f5503ece9e5eb7

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 22 Jun 2025, 17:36 UTC

MITRE ATT&CK techniques4 from threat tags

Technical details

Indicators of compromise

IP addresses 2

Hashes 4

Community reviews

Related threats