Exposing TAG-53’s Credential Harvesting Infrastructure Used for Russia-Aligned Espionage Operations

Recorded Future's Insikt Group describes TAG-53, a Russia-aligned threat activity group that conducts credential-harvesting phishing campaigns. The report identifies recurring infrastructure patterns (domain name structures, preferred registrars, a small set of ASNs, and Let's Encrypt TLS certificates), provides evidence of an operational spoofed sign-in page, and enumerates 38 malicious domains and multiple IPs as indicators, with mitigation guidance for detection and blocking.