TAG

Insikt Group identified four new TAG-195 ("Golden Chickens", “Venom Spider”) malware families through ongoing tracking of the TAG-195 MaaS ecosystem. We named two of the families "TinyEgg" and “ChonkyChicken"; the third is a modularized variant of ChonkyChicken. The fourth family, which includes a modified browser credential theft helper, we named “ChromEggscalator". TAG-195 is a financially motivated malware-as-a-service (MaaS) developer whose tooling Insikt Group has previously linked to TAG-127 as an operator and customer. (Insikt Group has directly observed TAG-127 deploying TinyEgg via “ClickFix”-style campaigns that use fake security verification pages to trick victims into manually executing malicious commands that download and install malware payloads via a legitimate Windows system utility.)

The four new families indicate an architectural transition and evolution in the TAG-195 MaaS ecosystem. TinyEgg is a lightweight initial-access backdoor providing host profiling, interactive shell access, and persistence management. ChonkyChicken substantially expands that capability with browser credential theft, browser session automation, credential-backed remote execution, network reconnaissance, and sustained surveillance. The modularized ChonkyChicken extends this design by introducing a controller-and-plugin architecture in which a base controller implant requests and loads discrete capability modules from attacker-controlled infrastructure on demand rather than embedding all functionality in the implant itself. TAG-195 also modified a publicly available Chrome encryption-bypass tool into a custom helper within the malware family that Insikt Group named ChromEggscalator. All four families a common set of architectural traits: consistent command-and-control mechanisms, a shared persistence approach, string obfuscation, and execution via the same delivery model.

Insikt Group assesses that TAG-195’s transition to a modular architecture almost certainly reduces the base implant's static detection exposure, and likely also reflects commercial incentives inherent to the MaaS model, including the ability to provision capabilities selectively to operators, limit exposure if a customer is compromised, and serve a broader range of operational requirements. Defenders should prioritize detection of ClickFix-style clipboard execution chains, misuse of legitimate system utilities to load payloads from user-writable directories, suspicious startup persistence mechanisms, browser processes launched with remote debugging enabled, and unusual outbound communications to attacker-controlled infrastructure.

TAG-195, also known as “Golden Chickens” or "Venom Spider", is a financially motivated MaaS developer with a long-standing history of providing credential theft and remote access tooling to criminal operators. Insikt Group assesses TAG-195 as a MaaS provider based on the availability of its malware to multiple distinct threat actors and its sustained operation across successive generations of tooling. Public reporting by eSentire has previously linked TAG-195 tooling to FIN6, Cobalt Group, and Evilnum, three financially motivated criminal groups, suggesting the ecosystem serves a select customer base; however, details on sales models and access conditions remain unknown. Additionally, Insikt Group tracks TAG-127 as a threat group that uses the TAG-195 MaaS, with ClickFix or VenomLNK as delivery methods.

Insikt Group previously reported on this development trajectory in April 2025, identifying TerraStealerV2 and TerraLogger as new TAG-195 malware families reflecting ongoing development aimed at credential theft and keylogging. That reporting noted TerraStealerV2's inability to bypass Chrome App-Bound Encryption (ABE) protections and TerraLogger's lack of C2 capabilities as indicators that the tools are still under active development. The families documented in this report represent continued development of the TAG-195 MaaS ecosystem, building directly on that prior trajectory by introducing Chrome ABE bypass capabilities and more robust C2 functionality.

The four malware families documented in this report represent a generational step beyond the TAG-195 tooling Insikt Group reported on in April 2025. That prior generation, including TerraStealerV2 and TerraLogger, reflected a development program still resolving fundamental capability gaps: TerraStealerV2 lacked the ability to bypass Chrome ABE, and TerraLogger had no C2 capability at all, leading Insikt Group to assess it as likely intended for a modular role that had not yet been identified. The current generation directly resolves both limitations. Modular ChonkyChicken realizes the modular architecture TerraLogger hinted at. TinyEgg and ChonkyChicken replace opportunistic exfiltration with a structured, bidirectional WebSocket tasking framework that supports sustained operator-directed operations. ChromEggscalator addresses the ABE gap with a dedicated bypass helper. The progression from RevC2, TerraStealerV2, and TerraLogger to the current generation of TinyEgg, ChonkyChicken, ChromEggscalator, and Modular ChonkyChicken indicates a deliberate architectural transition rather than incremental updates to existing tooling, with the modular controller-and-plugin design representing the most structurally distinct departure from prior Golden Chickens development observed to date.

TAG-127's observed TAG-195 campaigns used ClickFix as the initial access mechanism. ClickFix is a social engineering technique in which victims are presented with a fake security verification web page, typically mimicking a CAPTCHA prompt, that instructs them to manually copy and execute a malicious command. This approach bypasses conventional file and email delivery controls by inducing the victim to execute the payload themselves. TAG-127's lure pages instructed victims to open a system run dialog and paste a command copied to their clipboard (see Figure 3 ). Those commands downloaded OCX payloads from attacker-controlled staging infrastructure and executed them using a legitimate Windows system utility, completing the initial installation of TinyEgg on the victim host.t

Figure 3: ClickFix web page, screenly[.]cam, leveraged by TAG-127 to distribute malware

(Source: Recorded Future)

The delivery infrastructure used four lure domains ( Appendix A ) consolidated onto a single shared IP address, 70[.]34[.]205[.]43 , alongside a dedicated domain, xtrafftrck[.]net , which served both payload staging and command-and-control (C2) functions.

TinyEgg represents the first stage of a two-phase infection. Following successful installation and host registration, TinyEgg can receive operator instructions to download and execute ChonkyChicken, thereby substantially expanding the capabilities available on the compromised host. The full infection chain is illustrated in Figure 4 .

Insikt Group assesses that TAG-127's adoption of ClickFix delivery likely reflects the technique's effectiveness at circumventing email security controls and endpoint detection for file-based delivery methods, consistent with its broader adoption among financially motivated threat actors.

TinyEgg differs from prior TAG-195 tooling in a manner consistent with a deliberate tiered design: where earlier families such as TerraStealerV2 combined delivery and collection within a single package, TinyEgg is limited to initial access functions, deferring all post-exploitation capability to ChonkyChicken. The agentType field in TinyEgg's registration message returns the value "tiny" , indicating that the TAG-195 operator console likely distinguishes between implant generations and presents operators with different available actions depending on which implant is active on a given host.

TinyEgg is packaged as an OCX file and executed via a legitimate Windows system utility ( regsvr32.exe ), consistent with the broader TAG-195 execution model. Before initiating its main logic, TinyEgg verifies that its expected filename appears in both the active command line and the loaded module path. If either check fails, execution terminates immediately. This gating behavior prevents the implant from running outside its intended execution context, limiting its exposure in sandbox and automated analysis environments.

C2 ProtocolTinyEgg communicates with attacker-controlled infrastructure over WebSockets using a JSON-formatted, task-driven protocol. On initial , the C2 server issues a request_register command. TinyEgg responds with an agent_register message containing the victim's hostname, username, operating system, local IP address, domain or workgroup, and administrative privilege status (see Figure 5).

The use of WebSocket C2 poses an inherent challenge to network-based detection, independent of any application-layer obfuscation that TAG-195 applies. RFC 6455 mandates that all client-to-server WebSocket frames be XOR-masked with a per-frame random key included in plain text in the frame header. While this masking is easily reversible for analysts using standard tools such as Wireshark, signature-based intrusion detection systems cannot inspect WebSocket payload content without first implementing frame decoding, rendering content-based network signatures largely ineffective against this C2 channel. This protocol-level masking is also distinct from the application-layer XOR obfuscation TAG-195 applies to TinyEgg's operational strings, described below. The two represent separate and independent obfuscation layers.

TinyEgg's capabilities are intentionally narrow, consistent with its role as a first-stage implant whose primary purpose is to confirm access and prepare the host for ChonkyChicken. Interactive shell access is provided through four commands: shell_start , shell_input , shell_output , and shell_stopped . These launch a command interpreter in quiet mode and redirect input and output streams, giving operators a live command shell over the WebSocket channel.

Persistence is managed through persist_install and persist_remove . Installation stages the OCX payload to a user-writable local directory and creates a Run key pointing to the staged file, ensuring execution at each user logon via a legitimate Windows system utility. Removal deletes both the Run key value and the staged file. Each persistence operation returns a Boolean success or failure status via persist_result .

TinyEgg's command set reflects its role as a minimal first-stage implant. The nine observed commands cover only registration, interactive shell access, and persistence management.

Table 1: TinyEgg commands and descriptions (Source: Recorded Future)

Insikt Group assesses that TinyEgg's narrow capability set likely reflects a deliberate design decision to limit the implant's static-detection exposure during the initial-access stage. Separating initial access from post-exploitation capability reduces the risk that an early detection of TinyEgg reveals the full TAG-195 capability set available to an operator on a given host. The agentType field in TinyEgg's registration message is consistent with this assessment: the use of a tiered identifier indicates the TAG-195 operator console likely distinguishes between implant generations, presenting operators with different available actions depending on which implant is active on a compromised host.

ChonkyChicken represents the most fully featured implant in the current TAG-195 generation, consolidating browser credential theft, live browser session control, credential-backed lateral movement, network reconnaissance, and sustained surveillance within a single WebSocket-based framework. Insikt Group assesses that ChonkyChicken likely functions as a second-stage implant deployed after TinyEgg's initial access, with the two families' shared registration protocol, persistence model, and execution method indicating they were developed as complementary tiers within a common operational framework rather than as independent tools. ChonkyChicken's command set, detailed in Appendix B , is consistent with this assessment.

ChonkyChicken applies the same gating approach as TinyEgg, reinforcing that filename gating is a TAG-195 development standard. The implant masquerades as legitimate Windows component filenames and executes through its DllInstall export. Before proceeding, it validates that its expected filename appears in both the active command line and the loaded module path. If either check fails, execution terminates, and the implant writes a failure event to %TEMP%\lg.txt . That log file is forensically significant: its presence on a host is a reliable indicator of a ChonkyChicken execution attempt, whether or not the attempt succeeded. After initialization, ChonkyChicken profiles the host and registers with the controller using the same agent_register protocol as TinyEgg (see Figure 6 ), then remains connected as a long-lived task agent dispatching inbound operator commands through a central router.

ChonkyChicken's browser credential theft workflow resolves the most significant gap in the prior TAG-195 malware generation. Insikt Group's April 2025 reporting on TerraStealerV2 explicitly noted that the tool lacked the ability to bypass Chrome ABE, which the group assessed as evidence that the tool was still under active development. ChonkyChicken addresses that gap directly through a staged helper workflow using ChromEggscalator, a TAG-195-modified Chrome ABE bypass tool covered in detail in the ChromEggscalator section of this report.

The workflow follows a three-stage sequence. First, chrome_upload downloads ChromEggscalator, Base64-decodes it, and writes it to the victim's temporary directory. Second, chrome_ready confirms successful staging and returns the helper path to the controller. Third, chrome_extract executes the helper through a legitimate Windows system utility and collects the resulting output, including credential hashes and status data, from a temporary output directory. The collected material is packaged into a chrome_result message and exfiltrated to the controller.

ChonkyChicken extends beyond static credential extraction by implementing native Chrome DevTools Protocol (CDP) automation, enabling operators to interactively control live, authenticated browser sessions. This capability is analytically significant beyond what credential theft alone provides: an operator with an active CDP session can act as the authenticated user in real time, accessing live session-state, on-screen content, and authenticated resources that exist independently of stored credentials. An organization that resets passwords after an incident but fails to detect an active CDP session remains compromised. The cdp_start command launches the Chrome or Edge browser off-screen using negative window coordinates, enables remote debugging, and removes Chromium singleton artifacts before connecting to the local CDP endpoint. Operators relay CDP messages directly to the browser session via cdp_send , and cdp_message returns the browser's responses to the controller. Observed CDP traffic confirmed successful connection to a live browser session, with a Browser.getVersion request returning an active Edge version string (see Figure 7 ).

Credential Operations and Lateral Movement

ChonkyChicken's lateral movement capability transforms a single compromised host into a potential pivot point across the victim network, supporting the sustained operator-directed operations that the modular architecture is designed to enable. The implant imports Windows APIs for credential use and token manipulation, and retains command strings for the creation, execution, and deletion of remote scheduled tasks. Credential-backed execution via cred_exec and token-based execution via token_run provide operators with multiple paths to move laterally, depending on the credentials or tokens available on the host.

The remote_logon capability is particularly notable from a detection standpoint: it passively enumerates logged-on sessions without submitting credentials, generating no authentication events. This gives operators session visibility useful for lateral movement planning without alerting defenders. Observed cred_logon failures returned structured JSON error output, confirming the implant handles authentication errors.

ChonkyChicken's network reconnaissance capability is designed for enterprise environments, providing operators with a near-complete picture of the victim's local network before any lateral movement is attempted. TCP port scanning via net_port_scan identifies active services, including SMB, RDP, WinRM, SQL Server, PostgreSQL, HTTP/S, and SSH. ARP-based host discovery via net_arp_scan returns active hosts with their IP addresses, hostnames, and MAC addresses. The net_enumerate workflow combines ARP discovery, NetBIOS resolution, TCP scanning, and SMB enumeration into a single operation, returning IP address, MAC address, hostname, fully qualified domain name, domain name, operating system, and open ports. enumeration via net_share_enum identifies accessible remote network resources. Monitor topology enumeration via monitor_list records displays dimensions, coordinates, and the primary monitor status, likely supporting screen-capture targeting decisions.

The scope of this reconnaissance suite confirms that ChonkyChicken is not designed for opportunistic single-host credential theft. It is designed for operators who need to understand a network before moving through it.

ChonkyChicken supports four persistent surveillance capabilities that collectively provide operators with comprehensive real-time visibility into victim activity. Keylogging via dedicated commands records active window titles alongside captured keystrokes, providing context for interpreting captured input. Clipboard monitoring collects plaintext clipboard contents through clipboard_data messages. Audio capture returns Base64-encoded WAV-format recordings through audio_data messages. Screen capture uses Graphics Device Interface APIs to transmit live frames as raw binary WebSocket data rather than JSON-formatted messages.

ChonkyChicken retains a Web Proxy Auto-Discovery (WPAD) helper workflow that, when operational, positions the implant as a network proxy capable of intercepting victim network traffic. Similar to the chrome_upload task, WPAD functionality is enabled by delivering wpad_capture.ocx via a wpad_start task. At the time of analysis, this OCX file had not been observed.

ChonkyChicken uses the same persistence model as TinyEgg: the payload is staged to a user-writable local application data directory, and a Run key is created that points to the staged file, ensuring execution via a legitimate Windows system utility at each user logon. Removal deletes both the Run key value and the staged OCX file. The consistency of this approach across both implant generations is itself analytically significant. It confirms a TAG-195 development standard rather than independent implementation decisions, and means a single behavioral detection covering the Run key creation pattern applies across the entire current tool set.

ChromEggscalator is a TAG-195-modified version of ChromElevator, a publicly available open-source Chrome ABE bypass tool. Insikt Group's April 2025 reporting on TerraStealerV2 found that the family lacked ABE bypass capabilities, indicating that the credential theft implementation was either outdated or under active development at that time. ChromEggscalator addresses this limitation directly, and its integration into ChonkyChicken's staged browser theft workflow indicates it likely functions as a dedicated helper component within the TAG-195 ecosystem rather than as a standalone capability. TAG-195 developers modified the original tool by removing its command-line interface, repackaging it as an OCX file, adding filename validation logic, and redesigning its output model to support programmatic collection by ChonkyChicken's chrome_extract command.

TAG-195 made four specific modifications to adapt ChromElevator for use within its ecosystem, as what we call ChromEggscalator. First, the original command-line interface was removed entirely, preventing interactive use outside of its intended deployment context. Second, the tool was repackaged as an OCX file executable via a legitimate Windows system utility, aligning it with the standard TAG-195 execution model used across TinyEgg, ChonkyChicken, and Modular ChonkyChicken. Third, filename validation logic was added, requiring chromelevator.ocx to appear in both the command line and loaded module path before execution proceeds. Fourth, detailed operational logging to C:\ProgramData\xlog.txt was added, covering browser discovery, API resolution, output directory creation, and extraction activity.

The debug strings embedded in the validation logic are notable for more than their technical function. The checks report their results as Koki=[YES/NO] and Blat=[YES/NO] . The term "Koki" also appears as the controller filename in Modular ChonkyChicken, suggesting shared naming conventions across the development ecosystem and pointing toward a common developer or development environment across both tools.

ChromEggscalator executes through DllRegisterServer and applies the same filename gating approach used across the broader TAG-195 tool set. Before any operational logic runs, the tool validates that chromelevator.ocx appears in both the active command line and the loaded module path. If either check fails, execution terminates immediately. This prevents ChromEggscalator from running outside ChonkyChicken's controlled staging workflow, limiting its exposure in automated analysis environments.

Once gating checks pass, ChromEggscalator performs browser discovery, resolves the APIs required for ABE bypass, creates its output directory structure, and executes credential extraction. Extracted credential material, including hashes and status data, is written to a structured output directory under %TEMP%\output\ , where ChonkyChicken's chrome_extract command collects it and packages it for exfiltration via chrome_result .

ChromEggscalator writes a detailed operational log to C:\ProgramData\xlog.txt covering browser discovery, API resolution, output directory creation, and extraction activity. This log file is a reliable forensic indicator on any host where ChromEggscalator has executed, regardless of whether credential extraction succeeded. It is also distinct from ChonkyChicken's own log file at %TEMP%\lg.txt , meaning the two log files together can help analysts reconstruct the sequence of events on a compromised host.

The modifications TAG-195 developers made to ChromElevator — removing the command-line interface, adding filename gating, repackaging it as an OCX file, and redesigning the output model — are consistent with the execution and collection patterns applied across TinyEgg, ChonkyChicken, and Modular ChonkyChicken. Insikt Group assesses that these modifications likely reflect a deliberate effort to integrate ChromEggscalator into the existing TAG-195 execution ecosystem, as each change aligns the helper’s behavior with established TAG-195 development standards.

Modular ChonkyChicken represents a significant architectural departure from earlier TAG-195 malware. Rather than extending ChonkyChicken’s original all-in-one design, TAG-195 developed a dedicated controller implant responsible for WebSocket communications, host registration, task routing, and module lifecycle management, while operational capabilities are delivered via discrete plugins retrieved from C2 infrastructure as needed. Insikt Group assesses that this architecture likely reflects a deliberate shift toward operator-directed capability deployment rather than an incremental evolution of the existing implant, as the modular design reduces the static footprint of the base implant and enables selective delivery of functionality that monolithic malware architectures cannot readily support.

The Modular ChonkyChicken controller is delivered as an OCX file named koki.ocx or agent.ocx , and it executes via DllInstall as its primary execution path. Before any operational logic runs, the controller validates that koki.ocx appears in both the active command line and the loaded module path, consistent with the filename gating standard applied across every TAG-195 component in this report.

On initialization, the controller profiles the host, resolves required APIs, and establishes a WebSocket connection. The observed C2 endpoint during analysis was ws://localhost:3000/ws/agent . The use of localhost rather than an external C2 address almost certainly reflects a development or testing configuration rather than production infrastructure, suggesting Modular ChonkyChicken was captured at an early stage of operational deployment.

The controller maps inbound operator commands to capability modules rather than embedding functionality in the base implant. When a required module is not present on the host, the controller sends a module_request message to C2. The returned module is Base64-decoded, written to a randomly named temporary file, and loaded into memory through LoadLibraryA . This on-demand delivery model means the base controller implant contains no operational capability at rest; a defender who detects and captures the controller alone captures only the orchestration layer, not the capabilities it can deploy. A full list of module handling messages is provided in Table 2 .

Table 2: Modular ChonkyChicken module-handling commands (Source: Recorded Future)

Each module exposes a standardized three-function export interface:

At least fourteen capability modules have been identified, spanning the full operational range of ChonkyChicken's monolithic design. A detailed list of the supported module names and commands is provided in Table 3 .

Table 3: ChonkyChicken module command mappings (Source: Recorded Future)

Note that the wtrack module exposes the wtrack_start and wtrack_stop commands, but their purpose could not be determined from the available analysis. Its naming convention is consistent with the broader TAG-195 module taxonomy, and its presence in the module inventory suggests an active capability under development.

The modular branch retains the WPAD helper workflow present in ChonkyChicken. During wpad_start , the controller writes %TEMP%\wpad_capture.ocx , dynamically loads it, and invokes DllRegisterServer , reporting status through the same wpad_started , wpad_stopped , wpad_result , and wpad_hashes_result messages observed in ChonkyChicken. Its retention across both variants, despite the absence of a recovered WPAD helper sample, indicates TAG-195 developers consider WPAD interception a priority capability for the ecosystem.

The modular architecture confirms that TAG-195 is redesigning its tooling around a modular principle: deploy only what each intrusion requires, keep a minimal static footprint, and extend capabilities through plugins rather than installing updates

Defense Evasion and Shared Architectural Characteristics

The four families documented in this report, TinyEgg, ChonkyChicken, Modular ChonkyChicken, and ChromEggscalator, consistent traits that confirm a single coherent development framework operating to a deliberate design standard, not a collection of independently developed tools that happen to overlap. Every component in TAG-195’s current generation of malware applies the same evasion logic consistently.

Four evasion characteristics are present across all families in the current TAG-195 tool set.

Three architectural traits confirm a common development origin across TAG-195’s current generation of malware, independent of evasion intent:

The shared evasion traits and architectural characteristics documented in this report indicate that the TAG-195 MaaS ecosystem is undergoing a deliberate architectural transition rather than opportunistically producing new tools. A development framework that applies identical filename gating logic, persistence models, and execution methods across four independently deployable components is likely operating to a common design specification. Insikt Group assesses that the modular architecture likely represents the latest expression of that specification, consistent with a development approach oriented toward reducing exposure to static detection and enabling selective deployment of operator capabilities across a varied customer base.

Customers can deploy Recorded Future Hunting Packages and intelligence-driven detections for this new set of TAG-195 malware, including the Sigma and YARA rules shown below.

These controls address T1189 (Drive-by Compromise), T1204.004 (User Execution: Malicious Copy and Paste), T1059.003 (Command and Scripting Interpreter: Windows Command Shell), and T1218.010 (System Binary Proxy Execution: Regsvr32) relating to the ClickFix delivery chain and regsvr32-based OCX payload execution observed across all TAG-195 families in this report.

These controls address T1547.001 (Registry Run Keys / Startup Folder) Run key persistence under HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WinComCtl , observed identically across TinyEgg and ChonkyChicken.

These controls address T1555 (Credentials from Password Stores) and T1528 (Steal Application Access Token), associated with browser credential extraction via ChromEggscalator and live browser session control via CDP automation, as observed in ChonkyChicken.

These controls address T1071.001 (Web Protocols) and T1090 (Proxy), which relate to WebSocket-based C2 and proxy functionality observed across TinyEgg, ChonkyChicken, and Modular ChonkyChicken.

These controls address T1046 (Network Service Discovery), T1135 (Network Discovery), T1087.002 (Domain Account), T1049 (System Network Connections Discovery), T1018 (Remote System Discovery), T1021 (Remote Services), and credential-backed execution observed in ChonkyChicken.

Insikt Group assesses that TAG-195 will likely continue to iterate on its MaaS ecosystem, with an emphasis on development in modular payload delivery, browser credential access, and operator-driven post-compromise functionality. The progression from TerraStealerV2 and TerraLogger, documented in Insikt Group's April 2025 reporting, to the current generation of TinyEgg, ChonkyChicken, Modular ChonkyChicken, and ChromEggscalator, indicates sustained toolchain development rather than isolated malware production. The localhost C2 configuration in Modular ChonkyChicken suggests that portions of the current ecosystem remain under active development, and additional capability updates are likely.

The modular architecture introduced in the latest ChonkyChicken variant has implications for both defenders and TAG-195 operators that Insikt Group assesses will likely persist and deepen as the ecosystem matures. For defenders, a controller-only capture of a Modular ChonkyChicken deployment provides limited visibility into operational intent, as the base controller implant contains no operational capability at rest, and the module inventory available to a given operator is not recoverable from the controller alone. Detection efforts should prioritize the controller's behavioral indicators, WebSocket registration traffic, Run key creation, and OCX execution patterns, rather than capability-specific signatures that the modular design is structured to withhold. For TAG-195 as a MaaS provider, the modular architecture likely enables more flexible commercial packaging, selective capability provisioning to operators, and compartmentalization of operator activity, consistent with the operational and commercial incentives of a mature MaaS ecosystem.

Future TAG-195 activity will likely continue to feature ClickFix-style delivery, OCX payloads executed via regsvr32.exe , WebSocket C2, Run key persistence under a consistent value name, and on-demand module delivery. The wtrack module identified in the current Modular ChonkyChicken inventory, whose purpose could not be determined from available analysis, indicates at least one capability area under active development that may become observable in future TAG-195 deployments. Insikt Group will continue to monitor TAG-195 infrastructure, malware samples, and operator activity for further development across the current tool set and any subsequent tooling generations.

Table 5: Configuration and Operational Artifacts Associated with TAG-195 Malware (Source: Recorded Future)