Unmasking TAG-124: dissecting a prevalent traffic distribution system in the cybercriminal ecosystem

Unmasking TAG-124: dissecting a prevalent traffic distribution system in the cybercriminal ecosystem

Speakers: Julian-Ferdinand Vögele, Threat Researcher, Recorded Future

Conference: Virus Bulletin

YouTube: https://www.youtube.com/watch?v=Bm4SWLzgP8Y

Overview

In this insightful presentation at Virus Bulletin, Julian-Ferdinand Vögele, a Threat Researcher at Recorded Future, peeled back the layers of TAG-124, a sophisticated and increasingly prevalent Traffic Distribution System (TDS). Operating at the heart of the cybercriminal ecosystem, TAG-124 funnels victim traffic to malicious content based on a myriad of factors such as location and user behavior. The talk provided a comprehensive analysis of TAG-124's operational mechanics, infrastructure, and the diverse array of threat actors leveraging its services, highlighting its adaptability and evasive capabilities.

The significance of TAG-124 cannot be overstated. Since its initial observation in early 2024, this TDS has steadily expanded its reach, establishing a vast network of thousands of compromised WordPress sites alongside actor-controlled infrastructure. Its utility for cybercriminals lies in its ability to offer targeted, scalable, flexible, and evasive delivery of malicious payloads. Vögele's research not only dissects the technical intricacies of this system but also uncovers intriguing potential connections to prominent ransomware groups like Interlock, underscoring the critical role such foundational services play in the broader threat landscape.

This article delves into the detailed findings presented, exploring the infection chain, the architecture of TAG-124's infrastructure, the evolving lures employed by its users, and the defensive strategies necessary to counter this pervasive threat. The talk serves as a crucial warning to organizations and individuals about the hidden mechanisms redirecting unsuspecting users into the clutches of various cybercriminal operations, from information stealers to ransomware.

Background

▶ Watch: Introduction to TAG-124 and TDS primer (0:00)

Traffic Distribution Systems (TDS) have long been a cornerstone of the cybercriminal toolkit, acting as sophisticated intermediaries that direct internet users to specific content, whether benign or malicious. At their core, TDS analyze incoming traffic based on parameters such as geographical location, operating system, browser type, and referrer, then serve tailored content or redirect users accordingly. While legitimate applications exist (e.g., for advertising optimization), the term TDS in a security context almost exclusively refers to systems abused for malicious purposes, such as distributing malware, scams, or exploit kits.

The advantages of using a TDS for malicious actors are manifold. They offer targeted delivery, allowing threat actors to focus their efforts on specific demographics or vulnerabilities; scalability, enabling them to easily expand their reach by adding more infrastructure; flexibility, as they can dynamically change the follow-on lures or payloads; and perhaps most crucially, evasiveness, as the initial points of contact are often legitimate, albeit compromised, websites, making detection challenging.

TAG-124, also known in the industry by aliases such as Land Update 808, Kuki, or Chaya 002, emerged as a significant player in this space, first observed in early 2024. Despite its widespread use, detailed information about TAG-124 itself remains limited. This anonymity is largely due to the actors' operational security, which involves the use of compromised infrastructure, hosting providers that accept anonymous payments (e.g., cryptocurrency), and a lack of overt advertising for their services on public forums. The sheer number of diverse threat actors observed utilizing TAG-124, however, strongly suggests it operates as a service, likely within a closed cybercriminal circle.

Key Findings

▶ Watch: Evolution of lures: fake browsers to ClickFix (8:50)

Julian-Ferdinand Vögele's investigation into TAG-124 yielded several critical findings that illuminate its operational model and impact within the cybercriminal ecosystem:

1. Vast Network of Compromised WordPress Sites: TAG-124 relies on a massive network of thousands of compromised WordPress sites. These sites are opportunistically targeted, showing no specific sector or geographical focus, implying a broad-stroke approach to initial compromise. The fact that many of these sites have up-to-date WordPress core installations suggests exploitation of vulnerable plugins, use of leaked administrator credentials (often sourced from info-stealer campaigns), or successful spear-phishing attacks.
2. Sophisticated Multi-Stage Infection Chain: The TDS employs a layered infection process. It begins with an embedded script on a compromised WordPress site, leading to a first-stage TAG-124 server. This server then calls an external JavaScript that performs conditional logic based on victim profiling. Only if the victim passes these checks are they redirected to a follow-on malicious lure.
3. Adaptability and Evolving Lures: TAG-124 demonstrates remarkable adaptability in its evasion techniques. The C2 endpoint filenames, initially stable and predictable, were later randomized to hinder detection. More significantly, the lures themselves have evolved, moving from basic fake browser updates to increasingly sophisticated clickfix and filefix techniques. This evolution aligns with broader industry trends, with clickfix, in particular, seeing a 500% increase between 2024 and 2025 due to its enhanced evasiveness, user convincing nature, and versatility.
4. Resilient and Evasive Infrastructure: The TDS operates a highly structured, multi-tier infrastructure designed for resilience and to keep core components out of reach of law enforcement. The victim-facing components are frequently rotated and often hosted in target countries, while the central logic and management servers are strategically located in jurisdictions less amenable to international legal action.
5. Diverse User Base and Suspected Interlock Connection: TAG-124 is not exclusive to a single threat actor; it serves a wide array of groups, including state-aligned entities and various cybercriminal operations. A particularly compelling finding is the strong correlation observed between TAG-124 and the Interlock Ransomware group (and its linked entity, Residia). Evidence includes overlapping victim organizations, where a TAG-124 compromise was quickly followed by an Interlock infection, and instances where server infrastructure switched between being an Interlock C2 and a TAG-124 server. This suggests either a direct operational overlap, a close collaboration, shared services, or even staff overlap between the groups.

These findings paint a picture of TAG-124 as a highly effective and continuously adapting service that significantly contributes to the success of various malicious campaigns, making its dissection crucial for the cybersecurity community.

Technical Deep Dive

▶ Watch: Dissecting TAG-124's multi-tiered infrastructure (10:20)

The technical architecture and operational flow of TAG-124 are designed for efficiency, stealth, and resilience, enabling it to serve a diverse client base across the cybercriminal landscape.

Infection Chain Overview

The infection chain initiated by TAG-124 is a multi-stage process:

1. Initial Access: A victim visits a compromised WordPress site.
2. Embedded Script: The compromised site contains an embedded script tag that points to a URL hosted on a first-stage TAG-124 server.
3. External JavaScript Execution: This server then calls an externally hosted JavaScript file.
4. Conditional Logic: The JavaScript executes code to determine the next action. It performs checks based on victim characteristics (e.g., location, OS, IP address).
5. Lure Delivery or Evasion: If the victim passes the conditional logic, they are presented with a follow-on lure (e.g., fake browser update, clickfix prompt). If not, they might receive an error message or an empty page, effectively evading researchers and bots.

Stage 1: Compromised WordPress Sites

TAG-124's foundation is its vast network of compromised WordPress sites. Vögele estimates thousands of these sites are part of the network, with no discernible pattern in terms of sector or geography, indicating an opportunistic compromise strategy. While some sites remain infected indefinitely, others are cleaned up relatively quickly by their administrators.

A puzzling aspect is that most compromised sites run an up-to-date WordPress core. This suggests that the compromise vectors are not typically core WordPress vulnerabilities but rather:

• Vulnerable Plugins: The most likely vector, though no specific extensively exploited plugin has been identified.
• Leaked Admin Credentials: Many WordPress sites showed evidence of leaked admin credentials, often stolen by info-stealers like Luma and Var. TAG-124 operators could purchase these accesses for high-traffic sites.
• Spear-Phishing: A network of domains impersonating "WordPress engine" websites was observed, some even hosting login panels. These might be used for spear-phishing campaigns to gain administrative access.

A thought experiment presented highlighted the significant traffic potential: even with a conservative 1% chance of encountering a vulnerable WordPress site during a random page view, multiplying this by the number of internet users and average page views demonstrates a substantial funnel for TAG-124.

Stage 2: The TDS Logic and Server Interaction

The core of the TAG-124 TDS logic resides in a series of four JavaScript scripts executed after the initial redirect from the compromised WordPress site:

1. Bot/Researcher Evasion: The first script sets a cookie to prevent repeat visits from bots or researchers. To analyze the TDS, researchers must manually remove this cookie for each attempt.
2. Information Collection: The second script gathers various pieces of victim information, including operating system, location, and IP address. Notably, it leverages Cloudflare services to determine the victim's location. This collected data is then encoded.
3. C2 Communication: The encoded data is sent to a Command and Control (C2) server at a specific endpoint. Initially, this endpoint used stable PHP filenames, which allowed researchers to identify compromised sites. However, after public reporting, TAG-124 adapted by generating random PHP filenames, making detection via this method much harder.
4. Response Check: The final script checks the size of the response from the C2 server. If the response is larger than 35 bytes, it signifies a successful conditional pass, leading to the next stage (the lure). Otherwise, an error or empty page is displayed.

Stage 3: Evolving Follow-on Lures

TAG-124 continually adapts its lures to maintain effectiveness and evade detection:

• Fake Browsers: Initially, the primary lure was fake browser updates, prompting users to download malicious executables disguised as legitimate software updates.
• ClickFix: By early 2025, TAG-124 extensively adopted clickfix lures. These are highly interactive social engineering attacks where victims are instructed to open their browser's developer console and paste malicious JavaScript code. This technique is more evasive, convincing, and versatile, allowing actors to create custom lures. The industry has seen a roughly 500% increase in clickfix usage between 2024 and 2025, with even state-sponsored actors employing it to blend in with cybercriminal activity.
• FileFix: Most recently, TAG-124 has started using filefix, a subgroup of clickfix. In this variant, victims are prompted to paste malicious code into the address bar of their file explorer instead of the browser console, making it potentially even more convincing and dangerous.

Infrastructure Setup

TAG-124's infrastructure is a well-defined, multi-tier system:

1. Compromised WordPress Sites: The initial entry point, hosting the embedded script.
2. Tier 1 (Payload Servers): These are the victim-facing servers that receive requests from the compromised WordPress sites. They are continuously rotated to maintain anonymity and resilience.
3. Tier 2 (Central Server): This server is not victim-facing and is suspected to host the actual core logic of the TDS, determining which follow-on stage each visitor reaches based on the collected profiling data.
4. Tier 3 (Management Panel Server): This server administers the Tier 2 central server via SSH (port 22). Threat actors access a management panel on TCP port 9092. The panel itself is simplistic, featuring only a password field and requiring a specific user ID for access.
5. Ads Panel Servers: These servers are responsible for providing new payload URLs. WordPress engine servers (hosting the compromised sites) query a specific endpoint on these servers to retrieve the most recent URLs, enabling the continuous rotation of Tier 1 payload servers. Though related to URL distribution, the speaker clarified these are not victim-facing, but rather visible to the WordPress engine hosting servers and administered via SSH (port 22).
6. Backup Server: A backup server communicates with the Management Panel Server via a high UDP port, ensuring data persistence and recovery capabilities.

A critical observation about the infrastructure's geographical distribution is that components on the "left side" (victim-facing, e.g., compromised WordPress sites, Tier 1 payload servers) are often hosted in target countries. Conversely, components on the "right side" (actor-controlled, e.g., Tier 2, Tier 3, backup) are typically located in countries where law enforcement reach is limited, further enhancing the actors' operational security.

The Interlock Ransomware Connection

A significant part of the talk focused on the suspected special connection between TAG-124 and Interlock Ransomware, which overlaps with Residia. Interlock, active since September 2024, targets legal, health, and critical infrastructure sectors. It's highly likely Russia-based, with observed actor activity aligning with typical Russian work hours. Notably, Interlock does not operate an affiliate model, suggesting a direct operational structure.

The typical Interlock infection chain via TAG-124 involves:

1. Victim visits a TAG-124 compromised site.
2. Lure leads to a Windows shortcut.
3. Shortcut executes PowerShell.
4. PowerShell runs another PowerShell script.
5. This script loads and runs a PHP interpreter.
6. The PHP interpreter executes a PHP backdoor.
7. The backdoor leads to the deployment of the Interlock RAT, which has three different C2s across three different ASNs for resilience.
8. These C2s connect to an admin panel, from which the pattern-of-life analysis was derived.

The evidence for a special connection is compelling:

• Victim Overlap: An organization was compromised by TAG-124, then three days later, observed communicating with an Interlock RAT C2 server, and ten days later appeared on an Interlock data leak site. This occurred at least three times in a short period. While coincidence is possible, the short timeframes made it suspicious.
• Server Overlap: Several Interlock servers became TAG-124 servers, and vice-versa, within very short periods, suggesting a shared pool of infrastructure or direct repurposing.

Vögele explored several explanations for this connection:

• Coincidence: Deemed unlikely due to the specific, short-timeframe overlaps.
• Same Group, Two Business Models: Possible, but no direct evidence. Interlock is the only ransomware group observed consistently with TAG-124.
• Closer Collaboration: A more plausible scenario, akin to strong working relationships seen in legitimate threat intelligence.
• Shared Services (e.g., IABs): While a possibility, no direct evidence of initial access brokers was found.
• Staff Overlap: Cybercriminal actors often operate with multiple personas; individuals might work for both groups.

While definitive answers remain elusive, the strong correlations suggest a deeper relationship than mere transactional use of a TDS.

Demo / Proof of Concept

▶ Watch: Hypotheses for Interlock and TAG-124 overlap (17:20)

The talk focused on the analytical dissection of TAG-124 based on observed infrastructure, network traffic, and code analysis. There was no live demonstration or proof-of-concept presented during the session.

Defensive Implications

▶ Watch: Conclusion and remaining open questions (19:00)

Understanding TAG-124's sophisticated operations is crucial for bolstering defensive postures against a wide array of cyber threats. Defenders should implement a multi-layered strategy focusing on prevention, detection, and response across their environment.

For WordPress site owners and administrators, immediate action is paramount:

• Plugin Management: Regularly update all WordPress plugins and themes to their latest versions. Prioritize patches for known vulnerabilities. Consider a strict policy on plugin installation, using only reputable sources and limiting unnecessary plugins.
• Credential Security: Enforce strong, unique passwords for all administrative accounts. Implement Multi-Factor Authentication (MFA) for WordPress logins and associated hosting panels. Monitor for leaked credentials using services that track breaches, as info-stealers are a known vector for TAG-124.
• Website Monitoring: Implement continuous monitoring for unauthorized file changes, suspicious script injections, or unusual outbound connections from WordPress sites. Tools that scan for malicious code or indicators of compromise (IoCs) are invaluable.
• Web Application Firewall (WAF): Deploy a WAF to help block exploitation attempts against known plugin vulnerabilities and filter malicious traffic.

For network defenders and security operations centers (SOCs):

• Endpoint Detection and Response (EDR): Deploy robust EDR solutions to detect suspicious processes, especially PowerShell scripts running with unusual parameters, PHP interpreter execution, or the creation of Windows shortcuts from untrusted sources.
• Network Traffic Analysis: Monitor network traffic for connections to known TAG-124 C2 infrastructure, although actors rapidly rotate and randomize these. Focus on anomalous traffic patterns, such as unusual outbound connections from internal hosts or unexpected use of Cloudflare services for geolocation by internal applications.
• DNS Monitoring: Track DNS queries for newly registered or suspicious domains that might be part of TAG-124's rotating infrastructure or impersonating legitimate services.
• Lure Awareness Training: Educate users about the evolving nature of social engineering lures, specifically clickfix and filefix techniques. Emphasize the dangers of pasting commands into browser developer consoles or file explorer address bars.
• Threat Intelligence Integration: Integrate threat intelligence feeds that track TAG-124 and associated actors (like Interlock Ransomware) to proactively block known IoCs and understand emerging tactics, techniques, and procedures (TTPs).
• Segmentation: Implement network segmentation to limit the lateral movement of threats should an initial compromise occur.

Given TAG-124's continuous adaptation and its role as a service provider to diverse threat actors, a proactive and adaptive defense strategy is essential. Staying informed about its evolving methods and integrating intelligence into security controls will be key to mitigating its impact.

Key Takeaways

• TAG-124 is a Highly Adaptive and Widespread TDS: It continually evolves its infrastructure and evasion techniques, making it a persistent and challenging threat.
• Relies on Compromised WordPress Sites: Thousands of WordPress sites, often with up-to-date core installations, are opportunistically compromised via vulnerable plugins, leaked credentials, or spear-phishing.
• Employs Sophisticated Multi-Stage Infection and Evolving Lures: The infection chain is layered, and lures have progressed from fake browser updates to advanced clickfix and filefix techniques, aligning with broader cybercriminal trends.
• Infrastructure Designed for Resilience and Evasion: TAG-124 utilizes a multi-tier architecture with rotating victim-facing components and core infrastructure strategically located out of reach of law enforcement.
• Used by a Diverse Range of Threat Actors: State-aligned groups and various cybercriminals leverage TAG-124, with strong evidence suggesting a special connection or operational overlap with the Interlock/Residia Ransomware group.
• Detection is Challenging Due to Anonymity and Constant Adaptation: Its use of anonymous payment, compromised infrastructure, and dynamic C2 endpoints makes attribution and consistent detection difficult.

About the Speaker(s)

Julian-Ferdinand Vögele is a Threat Researcher at Recorded Future. His primary focus areas include the detection of malicious infrastructure, with a particular emphasis on mercenary spyware and cybercrime activities. His research into TAG-124 exemplifies his expertise in dissecting complex threat actor operations and understanding their impact on the global threat landscape.