TAG-110 Hackers Weaponize Word Templates for Targeted Attacks

A sophisticated cyber-espionage campaign has emerged targeting Tajikistan’s government institutions through weaponized Microsoft Word templates, marking a significant tactical evolution by the Russia-aligned threat group TAG-110.

The campaign, which unfolded between January and February 2025, represents a departure from the group’s historical methods and demonstrates their continued focus on intelligence gathering operations across Central Asia.

The malicious actors have shifted from their traditional approach of embedding HTA-based payloads within macro-enabled Word documents to utilizing macro-enabled Word template files with the .dotm extension.

This tactical evolution prioritizes persistence over immediate payload deployment, allowing the malware to establish a more durable foothold on targeted systems.

The campaign specifically targeted government ministries, educational institutions, and research organizations within Tajikistan using carefully crafted lure documents themed around radiation safety protocols for armed forces and election scheduling information.

Recorded Future analysts identified the campaign through detection of new TAG-110 first-stage payloads that exhibited distinct behavioral patterns from previous operations.

The researchers attributed the activity to TAG-110 based on code reuse from previous campaigns, overlap in command-and-control infrastructure, and the group’s characteristic use of legitimate government documents as lure material.

The threat actor, which overlaps with UAC-0063 and has been linked to APT28 with medium confidence, continues to support Russia’s broader strategic objectives of maintaining influence throughout the former Soviet sphere.

The malware samples analyzed, including the documents with SHA256 hashes d60e54854f2b28c2ce197f8a3b37440dfa8dea18ce7939a356f5503ece9e5eb7 and 8508003c5aafdf89749d0abbfb9f5deb6d7b615f604bbb11b8702ddba2e365e7, both communicate with the same command-and-control server at 38.180.206[.]61.

These files represent a notable departure from TAG-110’s previous reliance on HATVIBE, an HTA-based malware that had been their signature tool since at least 2023.

Persistence Through Startup Folder Manipulation

The most significant aspect of this campaign lies in TAG-110’s innovative persistence mechanism.

Upon execution, the malicious Word template copies itself to the Microsoft Word STARTUP folder located at %APPDATA%\Microsoft\Word\STARTUP\.dotm.

This placement transforms the malicious document into a global template that automatically executes whenever Microsoft Word is launched on the infected system.

The persistence mechanism operates through a sophisticated VBA macro structure that includes multiple sub-procedures.

The Document_Open() function initially unprotects the document using the hardcoded key “gyjyfyjrtjrtjhfgjfrthrtj” and copies the template to the startup directory.

Subsequently, the AutoExec() procedure executes automatically each time Word starts, implementing a timing check that prevents execution if less than 60 seconds have passed since the last run.

The malware then collects comprehensive system information including computer name, username, regional settings, monitor resolution, language preferences, and system version before establishing communication with its command-and-control infrastructure.

Equip your SOC team with deep threat analysis for faster response -> Get Extra 𝗦𝗮𝗻𝗱𝗯𝗼𝘅 𝗹𝗶𝗰𝗲𝗻𝘀𝗲𝘀 for Free