TAG-161
TAG-161 is a cybercrime syndicate with a financial motive, tracked by Brandefense. It uses 23 MITRE ATT&CK techniques.
- Techniques
- 23
- Exploited CVEs
- No CVE data
- Record updated
About TAG-161.
A threat cluster leveraging GrayBravo's CastleLoader MaaS, conducting ClickFix campaigns themed around Booking.com to distribute CastleLoader and Matanbuchus 3.0.
Last updated Jul 25, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.