# TAG-217

> As of 2026-10-19, TAG-217 is a threat actor tracked by Threadlinqs Intelligence across 2 threats spanning threat intel, data breach. ATT&CK coverage spans 25 techniques across 9 tactics in 2 of 2 tracked threats. Most-observed techniques: T1090 (Proxy), T1090.002 (External Proxy), T1119 (Automated Collection).

- **Tracked threats:** 2
- **Categories:** THREAT_INTEL, DATA_BREACH
- **As of:** 2026-10-19

## ATT&CK techniques observed

25 techniques observed across 2 of 2 tracked threats. Tactics: Reconnaissance (5), Command and Control (4), Resource Development (4), Exfiltration (3), Collection (2), Credential Access (2).

- [T1090](https://intel.threadlinqs.com/technique/T1090) Proxy — Command and Control — observed in 2 of 2 tracked threats
- [T1090.002](https://intel.threadlinqs.com/technique/T1090.002) External Proxy — Command and Control — observed in 2 of 2 tracked threats
- [T1119](https://intel.threadlinqs.com/technique/T1119) Automated Collection — Collection — observed in 2 of 2 tracked threats
- [T1190](https://intel.threadlinqs.com/technique/T1190) Exploit Public-Facing Application — Initial Access — observed in 2 of 2 tracked threats
- [T1583.003](https://intel.threadlinqs.com/technique/T1583.003) Virtual Private Server — Resource Development — observed in 2 of 2 tracked threats
- [T1588.002](https://intel.threadlinqs.com/technique/T1588.002) Tool — Resource Development — observed in 2 of 2 tracked threats
- [T1588.007](https://intel.threadlinqs.com/technique/T1588.007) Artificial Intelligence — Resource Development — observed in 2 of 2 tracked threats
- [T1595.002](https://intel.threadlinqs.com/technique/T1595.002) Active Scanning: Vulnerability Scanning — Reconnaissance — observed in 2 of 2 tracked threats
- [T1041](https://intel.threadlinqs.com/technique/T1041) Exfiltration Over C2 Channel — Exfiltration — observed in 1 of 2 tracked threats
- [T1046](https://intel.threadlinqs.com/technique/T1046) Network Service Discovery — Discovery — observed in 1 of 2 tracked threats
- [T1059](https://intel.threadlinqs.com/technique/T1059) Command and Scripting Interpreter — Execution — observed in 1 of 2 tracked threats
- [T1059.004](https://intel.threadlinqs.com/technique/T1059.004) Unix Shell — Execution — observed in 1 of 2 tracked threats
- [T1071.001](https://intel.threadlinqs.com/technique/T1071.001) Application Layer Protocol — Command and Control — observed in 1 of 2 tracked threats
- [T1078](https://intel.threadlinqs.com/technique/T1078) Valid Accounts — Initial Access — observed in 1 of 2 tracked threats
- [T1110](https://intel.threadlinqs.com/technique/T1110) Brute Force — Credential Access — observed in 1 of 2 tracked threats

## Tracked threats

- [TAG-217 Uses Claude Code, DeepSeek, Grok and ARTEX in AI-Assisted Attacks on South Korean Financial Institutions](https://intel.threadlinqs.com/threat/TL-2026-3860) — HIGH
- [Solo Threat Actor Uses ARTEX Agentic AI Pentest Tool to Breach South Korean Financial Organizations and Steal Data](https://intel.threadlinqs.com/threat/TL-2026-3040) — HIGH

## Full data

Infrastructure, IOC values and detection queries (Splunk SPL / Microsoft KQL / Sigma) require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/actor/TAG-217