28 - Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 18:48:26 UTC
 APT group: TAG-28
Names TAG-28 (Recorded Future)
Country China
Sponsor State-sponsored
Motivation Information theft and espionage
First seen 2021
Description
(Recorded Future) We have identified further suspected intrusions targeting the Indian media
conglomerate Bennett Coleman And Co Ltd (BCCL), commonly known as “The Times
Group”; the Unique Identification Authority of India (UIDAI); and the Madhya Pradesh Police
department. The UIDAI is the Indian government agency responsible for the national
identification database, more commonly called “Aadhaar”, which contains private biometric
information for over 1 billion Indian citizens. These intrusions were conducted by an activity
group we track using a temporary designation, TAG-28.
Observed
Sectors: Government, Media.
Countries: India.
Tools used Cobalt Strike, Winnti.
Information
Last change to this card: 02 November 2021
Download this actor card in PDF or JSON format
Source: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=43da3049-5058-42f7-92f5-cbb11a106278
https://apt.etda.or.th/cgi-bin/showcard.cgi?u=43da3049-5058-42f7-92f5-cbb11a106278
Page 1 of 1