TAG-100: New Threat Actor Uses Open-Source Tools for Widespread Attacks

Recorded Future's Insikt Group reports a suspected cyber-espionage campaign (TAG-100) where unknown actors exploit internet-facing appliances worldwide — including a critical Palo Alto GlobalProtect RCE (CVE-2024-3400, CVSS 10.0) — to gain initial access and deploy open-source Go backdoors (Pantegana, Spark RAT) and Cobalt Strike, targeting government, diplomatic, semiconductor, and other organizations across many countries.