TAG-195 Malware Ecosystem Shifts to Modular, Operator-Driven Architecture

Insikt Group identified four new malware families linked to TAG-195, signaling a strategic transition toward modular, operator-driven Malware-as-a-Service (MaaS) tooling. This architectural shift increases operational flexibility for threat actors, complicating attribution and defensive signature development.