The Massive, Hidden Infrastructure Enabling Big Game Hunting at Scale

Insikt Group documents a malicious traffic distribution system dubbed TAG-124 that cybercriminals and potentially state-linked actors use to direct victims to tailored malware and maximize successful infections. Multiple ransomware operators (including Rhysida and Interlock) and other threat actors leverage TAG-124 for big-game hunting against healthcare and critical infrastructure, resulting in large data thefts and high-impact incidents; the report outlines risks, observed actor activity, and mitigations such as advanced detections, user education, and secure browser settings.