← Traffic Distribution Systems in the Cybercrime Ecosystem
Module 1: Routing, Filtering, and Names
What a TDS Does—and Does Not Prove Why Victims and Sandboxes See Different Pages A Field Guide to TDS Names
Module 2: Named Services and Campaigns
Keitaro, ParrotTDS, TA2726, and SocGholish 404 TDS and TA584's Changing Initial Access Prometheus TDS, Cookie Reloaded, and TA866 VexTrio: Affiliate Traffic and DNS Routing
Module 3: Modern and Historical TDS Case Files
TAG-124, KongTuke, LandUpdate808, and Chaya_002 zTDS and the 2026 DriveSurge Cluster BlackTDS, Sutra, and the Drive-by Service Model
Module 4: Hosting, Networks, Investigation, and Disruption
Bulletproof Hosting in the TDS Ecosystem Fast Flux, Shared Hosting, CDNs, and Cloud Investigate and Disrupt the Complete Chain
Module 3: Modern and Historical TDS Case Files

TAG-124, KongTuke, LandUpdate808, and Chaya_002

Navigate overlapping labels for a modular compromised-WordPress delivery ecosystem.

In this lesson, you will learn to:

  • Describe the TAG-124 layered architecture.
  • Handle KongTuke and related aliases with explicit source scope.

TAG-124, KongTuke, LandUpdate808, and Chaya_002

Uses 2024–2026 research to connect injected sites, device checks, cookie gates, fake updates, fake CAPTCHA or ClickFix lures, payload servers, and overlapping vendor names.

The cluster is layered

Recorded Future described TAG-124 infrastructure observed in 2024 as a network of compromised WordPress sites, actor-controlled payload servers, a central command server, and other supporting components. Virus Bulletin’s 2025 research said TAG-124 overlaps with LandUpdate808, KongTuke, and Chaya_002 and described modular logic that collected device and operating-system data, checked cookies, and selected a fake Chrome update or fake CAPTCHA/ClickFix landing page.

These names are useful for correlating research, but avoid writing “all four names always mean exactly the same operator.” Record which source made the mapping and which layer it studied. Red Canary describes KongTuke as a malicious TDS using compromised WordPress sites to deploy changing lures. The shared core is a defensible behavioral model even where naming boundaries differ.

TAG-124 is a layered delivery stackA stacked architecture separates compromised sites, injected script, checks, lures, and payload infrastructure.LEARN IT VISUALLYTAG-124 is a layered delivery stackPayloadLureTDS logicInjected scriptWordPress sites
TAG-124 is a layered delivery stack — A stacked architecture separates compromised sites, injected script, checks, lures, and payload infrastructure.

Lures rotate while the funnel persists

The user may see a fake browser update, fake CAPTCHA, ClickFix instruction, or error depending on campaign state and visitor attributes. The lure is a presentation layer. Underneath it, the compromised-site supply, external script, cookie and device checks, command infrastructure, and payload handoff can provide more durable detection opportunities.

Collect the injected code and where it was inserted, external script URLs, parameter structure, cookies, request sequence, landing-page content, delivered artifacts, and endpoint processes. Website remediation must find persistence and the original access path. If only the visible lure domain is blocked, the TDS can rotate the destination while thousands of compromised sources continue feeding it.

KongTuke rotates the lure carouselA carousel cycles through fake update, CAPTCHA, ClickFix, and decoy presentations around one routing core.LEARN IT VISUALLYKongTuke rotates the lure carouselFake updateCAPTCHAClickFixDecoy
KongTuke rotates the lure carousel — A carousel cycles through fake update, CAPTCHA, ClickFix, and decoy presentations around one routing core.

Campaign evidence should remain temporal

A central server, certificate, domain, or IP can change. Passive DNS shows that a provider observed a relationship at a time; it does not establish permanent control. WordPress sites can be cleaned and later reinfected by another actor. Payload servers can host several customers or be reassigned.

Build a dated evidence table with first and last observation, collection source, relationship, confidence, and alternatives. Behavioral detections—unexpected external JavaScript on a website, cookie-gated navigation, fake verification pages, clipboard-to-shell execution, and browser-child processes—survive longer than a list of domains. Use indicators as time-bounded accelerators, not as the entire analytic product.

Resources

  • Virus Bulletin 2025: TAG-124 — Read the technical paper on TAG-124 modular routing, label overlaps, URL rotation, and delivery logic.
  • Red Canary: KongTuke — Use the current threat profile for behavioral analysis and defensive actions.
← Previous: VexTrio: Affiliate Traffic and DNS Routing Next: zTDS and the 2026 DriveSurge Cluster →