[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fyAsx19rvsHJkGzLaNgEOjy9-Sxa86iZiFxLOtNHCz1E":3},{"success":4,"data":5},true,{"name":6,"slug":7,"aliases":8,"description":10,"country":11,"suspected_sponsor":12,"target_industries":13,"target_countries":14,"incident_types":15,"references":16,"techniques":19,"technique_count":20,"created_at":21,"seoMetadata":22,"schemaOrg":26},"Storm-2077","storm-2077",[9],"TAG-100","TAG-100 is a cyber-espionage APT that targets government and private sector organizations globally, exploiting vulnerabilities in internet-facing devices such as Citrix NetScaler and F5 BIG-IP for initial access. The group employs open-source tools like Pantegana and SparkRAT for persistence and post-exploitation activities, including credential theft and email data exfiltration. TAG-100 has compromised entities in at least ten countries, including two Asia-Pacific intergovernmental organizations, and focuses on sectors like education, finance, and local government. Their operations highlight the challenges of attribution due to the use of off-the-shelf tools and techniques that overlap with other state-sponsored groups.","CN",null,[],[],[],[17,18],"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2024\u002F11\u002F22\u002Fmicrosoft-shares-latest-intelligence-on-north-korean-and-chinese-threat-actors-at-cyberwarcon\u002F","https:\u002F\u002Fwww.recordedfuture.com\u002Fresearch\u002Ftag-100-uses-open-source-tools-in-suspected-global-espionage-campaign",[],0,"2024-12-23T02:15:04.877712+00:00",{"title":23,"metaDescription":24,"keywords":25},"Storm-2077 Threat Actor Profile | EdgeProtect","TAG-100 is a cyber-espionage APT that targets government and private sector organizations globally, exploiting vulnerabilities in internet-facing devi...","Storm-2077, TAG-100, threat actor, APT, cyber threat, threat intelligence, CN",{"@context":27,"@type":28,"name":6,"alternateName":29,"description":10,"url":30,"mainEntityOfPage":31,"location":33},"https:\u002F\u002Fschema.org","Organization",[9],"http:\u002F\u002Flocalhost:3000\u002Fthreat-actors\u002Fstorm-2077",{"@type":32,"@id":30},"WebPage",{"@type":34,"name":11},"Country"]