TAG-193 Targets Diplomacy and Resources in Russia, CIS States via Spearphishing

Joint research by Cisco Talos and Recorded Future identifies sustained cyber-espionage operations by the threat actor TAG-193. The group targeted government institutions across Central Asia and the wider Commonwealth of Independent States from early 2025 through May 2026.

The investigation highlights a strategic focus on entities managing diplomacy, agriculture, and environmental resources. These organizations hold data critical for regional negotiations and security planning. Shared infrastructure and river systems give this information particular strategic value in the region.

Context and Background

TAG-193’s activity correlated with specific diplomatic developments. Communications between a Tajik economic development entity and TAG-193 infrastructure occurred after Kazakhstan considered a treaty with Tajikistan. Similarly, activity involving a Belarusian agriculture entity preceded a bilateral meeting in Astana.

While these timing links do not prove direct connection to the events, they indicate the group’s targeting interests. The operators appear to seek intelligence that could inform economic planning and regional security decisions for state actors.

Who Is Affected

The research identified targeting of government entities in Russia, Tajikistan, Belarus, Armenia, and Uzbekistan. Lure documents suggested additional interests across the region. The group frequently sent spearphishing emails from compromised official accounts to boost credibility.

Identified lures included a diplomatic letter to Armenia’s Foreign Ministry and a Turkmenistan airspace form. Another lure involved a business proposal for Russia’s Orsk Oil Refinery. These documents indicate targeting interests but do not confirm successful compromises of those specific organizations.

What should you do?

TAG-193 uses public services like GitHub to host malicious scripts. Trusted sender accounts help malicious content blend into routine workflows. Exposed directories on the group’s infrastructure revealed malware and a previously undocumented GitHub staging account.

These operational security lapses enabled researchers to connect campaigns. The group’s reliance on familiar hosting services and impersonated services suggests a methodical approach to blending in with normal government operations.

What to do and how to stay safe: TAG-193

• Verify the authenticity of unexpected emails from government or diplomatic contacts, even if they appear to come from known addresses.
• Monitor for suspicious activity linked to compromised official accounts, particularly those sending documents related to sensitive negotiations or resource management.
• Inspect links and attachments in emails referencing official forms, such as airspace applications or diplomatic letters, before opening them.
• Review logs for connections to known TAG-193 infrastructure or unusual GitHub repository access, as the group uses these platforms for staging.

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which countries were targeted by TAG-193 in this campaign?

The research identified activity involving government entities in Russia, Tajikistan, Belarus, Armenia, and Uzbekistan.

What sectors did TAG-193 focus on?

The group targeted institutions responsible for diplomacy, economic development, agriculture, and environmental management.

Did TAG-193 successfully compromise the organizations mentioned in the lures?

The source material states that the lures indicate targeting interests but do not independently establish successful compromises of those specific organizations.