TAG124

A malicious traffic-distribution system or activity cluster used to route victims to malware, including Interlock campaigns. It has delivered deceptive installers and PowerShell-based backdoors; it is better understood as shared delivery infrastructure than as a uniquely bounded human threat group.