TAG-124Threat actor
- LandUpdate808
TAG-124 is a threat actor that employs a traffic distribution system to distribute malware, primarily using MintsLoader and targeting various sectors through phishing emails and compromised websites. The actor injects malicious JavaScript into WordPress sites, leading victims to fake Google Chrome update landing pages that facilitate malware downloads, often masquerading as legitimate updates.From MISP Galaxy
Last reported 15 months ago, by The DFIR Report1 report
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1110Brute Force
“SQL Brute Force Leads to BlueSky Ransomware”
- T1543.003Windows Service
“…n includes detailed system specifications (systeminfo), a list of all running processes and associated services (tasklist), running Windows services (Get-Service), all mounted drives (Get-PSDrive), and the local network neighborhood via the ARP table (Get-NetNeighbor).”
What the reports say
1 report, newest first · the exact sentence from each-
KongTuke FileFix Leads to New Interlock RAT Variant“Since May 2025, activity related to the Interlock RAT has been observed in connection with the LandUpdate808 (aka KongTuke) web-inject threat clusters.”
Indicators in its reports
named in the reports above- hxxp://deadly-programming-attorneys-our.trycloudflare[.]comin 1 report
- deadly-programming-attorneys-our.trycloudflare[.]comin 1 report
- result[.]propertiesin 1 report
- 28a9982cf2b4fc53…fa0ca7f7b7d3in 1 report
- 8afd6c0636c5d70a…d939377727b0in 1 report
- existed-bunch-balance-councils.trycloudflare[.]comin 1 report
- ferrari-rolling-facilities-lounge.trycloudflare[.]comin 1 report
- galleries-physicians-psp-wv.trycloudflare[.]comin 1 report
- evidence-deleted-procedure-bringing.trycloudflare[.]comin 1 report
- nowhere-locked-manor-hs.trycloudflare[.]comin 1 report
- ranked-accordingly-ab-hired.trycloudflare[.]comin 1 report
- 64.95.12[.]71in 1 report
- 184.95.51[.]165in 1 report
Copy these 13 indicators · defanged
Thanks — we review every report.