Russia-Aligned TAG-110 Targets Tajikistan with Macro-Enabled Word Documents

Insikt Group observed a TAG-110 (Russia-aligned) spearphishing campaign against Tajikistan in Jan–Feb 2025 that delivers macro-enabled Word templates (.dotm) which copy themselves into the Word STARTUP folder to achieve persistence, contact C2 at 38.180.206.61 via HTTP POSTs, and fetch/execute additional VBA-based payloads; the report includes detailed VBA analysis, IOCs (IP addresses and SHA256 hashes), mitigation recommendations, and assesses continued regional espionage risk.