Nation-state APTEspionage
TAG-28
TAG-28 is a China-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets the Government, and Media and Entertainment sectors in India.
- Origin
- China
- Techniques
- 0
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2021
- Record updated
Who They Target.
Sectors · 2
Countries · 1
About TAG-28.
TAG-28 is a Chinese state-sponsored threat actor that has been targeting Indian organizations, including media conglomerates and government agencies. They have been using the Winnti malware, which is commonly shared among Chinese state-sponsored groups. TAG-28's main objective is to gather intelligence on Indian targets, potentially for espionage purposes.
Last updated Oct 9, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.