TAG-144 APT Group Maintains Persistent Cyber Espionage Campaign Against South American Organizations

Sustained Espionage Campaign Targeting Regional Organizations

Recorded Future's intelligence analysis reveals that TAG-144, a Chinese state-affiliated advanced persistent threat group, has maintained continuous cyber espionage operations against South American organizations between May 2024 and July 2025. The campaign demonstrates sophisticated targeting strategies focused on government agencies and private sector entities across the region.

Victim Profile Analysis

The comprehensive assessment documents TAG-144's systematic targeting of organizations maintaining some degree of affiliation with state infrastructure. The group's victim selection criteria indicate strategic intelligence collection objectives aligned with Chinese geopolitical interests in South American markets and governance structures.

Operational Persistence and Evolution

The 14-month operational timeframe documented by Recorded Future represents one of the longest continuously observed Chinese espionage campaigns targeting a specific geographic region. This persistence indicates significant intelligence value placed on South American targets and suggests ongoing collection requirements from Chinese intelligence services.

Regional Infrastructure Targeting

Analysis indicates TAG-144 operations focus on critical infrastructure sectors, government communications networks, and economic institutions across multiple South American countries. This broad targeting approach suggests intelligence collection objectives encompassing political, economic, and strategic infrastructure information.

Attribution and State Affiliation

While maintaining operational security measures typical of advanced persistent threat groups, TAG-144's targeting patterns, operational timeframes, and technical capabilities align with Chinese state intelligence collection priorities. The group's sustained focus on South American targets reflects broader Chinese strategic interests in the region.

Implications for Regional Security

The documented campaign highlights growing cyber espionage threats facing South American nations as they navigate increasing geopolitical competition. The sustained nature of TAG-144 operations suggests the need for enhanced regional cybersecurity cooperation and threat intelligence sharing mechanisms.