TAG-195
TAG-195 is a Russia-attributed cybercrime syndicate with a financial motive, tracked by Brandefense. It targets 4 sectors, including Finance and Healthcare, in the United States. It uses 6 MITRE ATT&CK techniques.
- Golden Chickens
- Venom Spider
- TA4557
- Origin
- Russia
- Techniques
- 6
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2017
- Record updated
Who They Target.
About TAG-195.
These campaigns primarily targeted US companies in various industries including retail, entertainment, pharmacy, and others that commonly employ online payments, such as online shopping portals. The actor sending these campaigns attempts to establish rapport with potential victims by abusing LinkedIn’s direct messaging service. In direct follow-up emails, the actor pretends to be from a staffing company with an offer of employment. In many cases, the actor supports the campaigns with fake websites that impersonate legitimate staffing companies. These websites, however, host the malicious payloads. In other cases, the actor uses a range of malicious attachments to distribute More_eggs. Taurus Loader has been observed to distribute GandCrab and Sodinokibi ({{Pinchy Spider, Gold Southfield}}) and Trickbot ({{Wizard Spider, Gold Blackburn}}), as well as their own tool More_eggs.
Last updated Sep 11, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.