Russia-Aligned TAG-70 Targets European Government and Military Mail Servers in New Espionage Campaign

Recorded Futures Insikt Group has identified TAG-70, a threat actor likely operating on behalf of Belarus and Russia, conducting cyber-espionage against targeting government, military, and national infrastructure entities in Europe and Central Asia since at least December 2020. In its latest campaign, which ran between October and December 2023, TAG-70 exploited cross-site scripting (XSS) vulnerabilities in Roundcube webmail servers in its targeting of over 80 organizations, primarily in Georgia, Poland, and Ukraine. This activity is reminiscent of other Russian-aligned threat …

actor asia belarus campaign central asia cyber december entities espionage europe futures government infrastructure insikt group latest mail malware analysis military national national infrastructure october russia servers tag targeting threat threat actor