Recorded Future Links TAG-193 to Central Asian Espionage Campaigns

Researchers document state-linked intrusions targeting diplomatic and resource sectors across CIS nations through phishing and code hosting.

Campaigns targeted government entities in Russia, Tajikistan, Belarus, Armenia, and Uzbekistan.

Operators used compromised accounts and GitHub to distribute malicious documents and scripts.

Interests included water security, forestry management, and regional diplomatic negotiations.

Recorded Future and Cisco Talos released a joint analysis of TAG-193 operations spanning early 2025 to May 2026. The group focused on intelligence collection within Central Asia and the Commonwealth of Independent States.

TAG-193 conducted sustained espionage operations targeting government institutions across five nations. Researchers identified intrusions involving entities in Russia, Tajikistan, Belarus, Armenia, and Uzbekistan. The group focused on organizations managing diplomacy, economic development, agriculture, and environmental resources. These sectors hold data valuable for regional security and economic planning.

The operators relied heavily on spearphishing emails sent from compromised government accounts. They attached official-looking documents to increase credibility. Lures included a diplomatic letter for Armenia’s foreign ministry and an airspace application form for Turkmenistan. Another email contained a business proposal related to a Russian oil refinery. These materials indicate specific targeting interests rather than broad spam campaigns.

TAG-193 also utilized public services like GitHub to host malicious scripts and payloads. This approach helps blend malicious content into routine workflows. Exposed directories on group infrastructure revealed additional malware samples. Researchers also found a previously undocumented GitHub staging account. These operational security lapses allowed analysts to trace changes in the group’s tooling.

The timing of some intrusions aligns with significant diplomatic developments. Communications involving a Tajik economic entity occurred after Kazakhstan considered a treaty with Tajikistan. Activity linked to a Belarusian agriculture agency preceded a bilateral meeting in Astana. While temporal links do not prove direct connection, they highlight the group’s focus on diplomatic priorities.

Water security and resource management remain central to the campaign. An Armenian environmental agency and Uzbekistan’s Smart Forestry initiative were among the targets. Activity also involved Nizhny Novgorod, Russia, located near major river confluences. Earlier reporting connected TAG-193 to water-resource organizations in Central Asia. Shared river systems and interconnected infrastructure give this data strategic value.

Climate change and glacier loss increase pressure on water availability in the region. Dependence on cross-border supplies leaves nations exposed to upstream decisions. The historical Aral Sea disaster illustrates the long-term consequences of water mismanagement. These factors explain why environmental data holds high strategic importance for intelligence collectors.

Our take on the response

Monitor for phishing emails originating from known government or official addresses.

Inspect attachments that mimic diplomatic letters, airspace forms, or business proposals.

Review GitHub repositories for unauthorized hosting of scripts or staging accounts.

Check for exposed directories on internal infrastructure that may leak tooling details.

What defenders should look for

Security teams should examine email logs for messages from compromised official accounts. Look for attachments that mimic routine bureaucratic documents like treaties or applications. Monitor web proxies for requests to GitHub repositories hosting executable scripts. Check for unusual network connections to infrastructure associated with known threat actors. Verify that internal directories are not publicly accessible. Review access logs for environmental and diplomatic departments for anomalous activity.

What to do and how to stay safe: TAG-193

Audit external-facing directories to ensure no sensitive code or tools are exposed.

Implement strict attachment filtering for emails from government or official domains.

Monitor for outbound connections to public code-hosting sites from workstations.

Review user activity in high-value departments such as diplomacy and agriculture.

Step-by-step guide: Indicators of Compromise: 6 Common Misreadings That Fail in Detection

General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which countries were targeted by TAG-193 in this campaign?

The group targeted entities in Russia, Tajikistan, Belarus, Armenia, and Uzbekistan.

What types of documents did the group use as lures?

They used diplomatic letters, airspace application forms, and business proposals.

How did TAG-193 host its malicious payloads?

The group used public services like GitHub to host scripts and payloads.