TAG-124’s Multi-Layered TDS Infrastructure and Extensive User Base

Recorded Future’s Insikt Group describes TAG-124, a multi-layered traffic distribution system that compromises WordPress sites and uses actor-controlled servers and fake Google Chrome update pages (including the ClickFix technique) to deliver malware such as REMCOS RAT, loaders, and multiple ransomware families (Rhysida, Interlock), outlining infrastructure components, infection chains, and numerous IoCs tied to an active, evolving criminal service.