Threat Analysis Group (TAG)https://blog.google/threat-analysis-group/Threat Analysis Group (TAG)en-usThu, 29 Jan 2026 19:30:00 +0000https://blog.google/threat-analysis-group/static/blogv2/images/google.pngThreat Analysis Group (TAG)https://blog.google/threat-analysis-group/TAG Bulletin: Q4 2025https://blog.google/threat-analysis-group/tag-bulletin-q4-2025/An overview of coordinated influence operation campaigns terminated on our platforms in Q4 2025.Thu, 29 Jan 2026 19:30:00 +0000https://blog.google/threat-analysis-group/tag-bulletin-q4-2025/Threat Analysis GrouparticleTAG Bulletin: Q4 2025An overview of coordinated influence operation campaigns terminated on our platforms in Q4 2025.Googlehttps://blog.google/threat-analysis-group/tag-bulletin-q4-2025/Billy Leonard<department>Threat Analysis Group</department><company/></author></item><item><title>TAG Bulletin: Q3 2025https://blog.google/threat-analysis-group/tag-bulletin-q3-2025/Our bulletin covering coordinated influence operation campaigns terminated on our platforms in Q3 2025.Thu, 13 Nov 2025 16:00:00 +0000https://blog.google/threat-analysis-group/tag-bulletin-q3-2025/Threat Analysis GrouparticleTAG Bulletin: Q3 2025Our bulletin covering coordinated influence operation campaigns terminated on our platforms in Q3 2025.Googlehttps://blog.google/threat-analysis-group/tag-bulletin-q3-2025/Billy Leonard<department>Threat Analysis Group</department><company/></author></item><item><title>TAG Bulletin: Q2 2025https://blog.google/threat-analysis-group/tag-bulletin-q2-2025/Our bulletin covering coordinated influence operation campaigns terminated on our platforms in Q2 2025.Mon, 21 Jul 2025 17:45:00 +0000https://blog.google/threat-analysis-group/tag-bulletin-q2-2025/Threat Analysis GrouparticleTAG Bulletin: Q2 2025Our bulletin covering coordinated influence operation campaigns terminated on our platforms in Q2 2025.Googlehttps://blog.google/threat-analysis-group/tag-bulletin-q2-2025/Billy Leonard<department>Threat Analysis Group</department><company/></author></item><item><title>TAG Bulletin: Q1 2025https://blog.google/threat-analysis-group/tag-bulletin-q1-2025/This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q1 2025. It was last updated on May 15, 2025.JanuaryWe terminated 12 YouT…Thu, 15 May 2025 17:30:00 +0000https://blog.google/threat-analysis-group/tag-bulletin-q1-2025/Threat Analysis GrouparticleTAG Bulletin: Q1 2025Googlehttps://blog.google/threat-analysis-group/tag-bulletin-q1-2025/Billy Leonard<department>Threat Analysis Group</department><company/></author></item><item><title>TAG Bulletin: Q4 2024https://blog.google/threat-analysis-group/tag-bulletin-q4-2024/This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q4 2024. It was last updated on February 19, 2024.OctoberWe terminated 11…Tue, 17 Dec 2024 22:00:00 +0000https://blog.google/threat-analysis-group/tag-bulletin-q4-2024/Threat Analysis GrouparticleTAG Bulletin: Q4 2024Googlehttps://blog.google/threat-analysis-group/tag-bulletin-q4-2024/Billy Leonard<department>Threat Analysis Group</department><company/></author></item><item><title>TAG Bulletin: Q3 2024https://blog.google/threat-analysis-group/tag-bulletin-q3-2024/This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q3 2024. It was last updated on January 14, 2025.JulyWe terminated 89 You…Thu, 12 Sep 2024 23:30:00 +0000https://blog.google/threat-analysis-group/tag-bulletin-q3-2024/Threat Analysis GrouparticleTAG Bulletin: Q3 2024Googlehttps://blog.google/threat-analysis-group/tag-bulletin-q3-2024/Billy Leonard<department>Threat Analysis Group</department><company/></author></item><item><title>State-backed attackers and commercial surveillance vendors repeatedly use the same exploitshttps://blog.google/threat-analysis-group/state-backed-attackers-and-commercial-surveillance-vendors-repeatedly-use-the-same-exploits/an image of a blue square with the embedded text "Google" and "Threat Analysis Group"<img src="https://storage.googleapis.com/gweb-uniblog-publish-prod/images/TAG_PzwyAeM.width-1600.format-w.max-600x600.format-webp.webp">We’re sharing an update on suspected state-backed attacker APT29 and the use of exploits identical to those used by Intellexa and NSO.Thu, 29 Aug 2024 13:00:00 +0000https://blog.google/threat-analysis-group/state-backed-attackers-and-commercial-surveillance-vendors-repeatedly-use-the-same-exploits/Safety & SecurityThreat Analysis GrouparticleState-backed attackers and commercial surveillance vendors repeatedly use the same exploitsWe’re sharing an update on suspected state-backed attacker APT29 and the use of exploits identical to those used by Intellexa and NSO.Googlehttps://blog.google/threat-analysis-group/state-backed-attackers-and-commercial-surveillance-vendors-repeatedly-use-the-same-exploits/Clement Lecigne<department>Threat Analysis Group</department><company/></author></item><item><title>Iranian backed group steps up phishing campaigns against Israel, U.S.https://blog.google/threat-analysis-group/iranian-backed-group-steps-up-phishing-campaigns-against-israel-us/Google’s Threat Analysis Group shares insights on APT42, an Iranian government-backed threat actor.Wed, 14 Aug 2024 19:00:00 +0000https://blog.google/threat-analysis-group/iranian-backed-group-steps-up-phishing-campaigns-against-israel-us/Safety & SecurityThreat Analysis GrouparticleIranian backed group steps up phishing campaigns against Israel, U.S.Google’s Threat Analysis Group shares insights on APT42, an Iranian government-backed threat actor.Googlehttps://blog.google/threat-analysis-group/iranian-backed-group-steps-up-phishing-campaigns-against-israel-us/Google Threat Analysis Group<department/><company/></author></item><item><title>Google disrupted over 10,000 instances of DRAGONBRIDGE activity in Q1 2024https://blog.google/threat-analysis-group/google-disrupted-dragonbridge-activity-q1-2024/Today we are sharing updated insights about DRAGONBRIDGE, the most prolific IO actor Google’s Threat Analysis Group (TAG) tracks.Wed, 26 Jun 2024 10:00:00 +0000https://blog.google/threat-analysis-group/google-disrupted-dragonbridge-activity-q1-2024/Threat Analysis GrouparticleGoogle disrupted over 10,000 instances of DRAGONBRIDGE activity in Q1 2024Today we are sharing updated insights about DRAGONBRIDGE, the most prolific IO actor Google’s Threat Analysis Group (TAG) tracks.Googlehttps://blog.google/threat-analysis-group/google-disrupted-dragonbridge-activity-q1-2024/Zak ButlerThreat Analysis GroupTAG Bulletin: Q2 2024https://blog.google/threat-analysis-group/tag-bulletin-q2-2024/Our bulletin covering coordinated influence operation campaigns terminated on our platforms in Q2 2024.Tue, 04 Jun 2024 23:00:00 +0000https://blog.google/threat-analysis-group/tag-bulletin-q2-2024/Threat Analysis GrouparticleTAG Bulletin: Q2 2024Our bulletin covering coordinated influence operation campaigns terminated on our platforms in Q2 2024.Googlehttps://blog.google/threat-analysis-group/tag-bulletin-q2-2024/Billy Leonard<department>Threat Analysis Group</department><company/></author></item><item><title>A review of zero-day in-the-wild exploits in 2023https://blog.google/innovation-and-ai/technology/safety-security/a-review-of-zero-day-in-the-wild-exploits-in-2023/Today, Google released its report “We’re All in this Together: A Year in Review of Zero-Days Exploited In-the-Wild in 2023.”Wed, 27 Mar 2024 13:00:00 +0000https://blog.google/innovation-and-ai/technology/safety-security/a-review-of-zero-day-in-the-wild-exploits-in-2023/Safety & SecurityThreat Analysis GrouparticleA review of zero-day in-the-wild exploits in 2023Today, Google released its report “We’re All in this Together: A Year in Review of Zero-Days Exploited In-the-Wild in 2023.”Googlehttps://blog.google/innovation-and-ai/technology/safety-security/a-review-of-zero-day-in-the-wild-exploits-in-2023/Maddie Stone<department>Threat Analysis Group</department><company/></author><author xmlns:author="http://www.w3.org/2005/Atom"><name>James Sadowski</name><title>Principal Analyst, Mandiant IntelligenceTAG Bulletin: Q1 2024https://blog.google/threat-analysis-group/tag-bulletin-q1-2024/This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q1 2024. It was last updated on July 8, 2024.JanuaryWe blocked 4 domains …Wed, 06 Mar 2024 17:30:00 +0000https://blog.google/threat-analysis-group/tag-bulletin-q1-2024/Threat Analysis GrouparticleTAG Bulletin: Q1 2024Googlehttps://blog.google/threat-analysis-group/tag-bulletin-q1-2024/Shane HuntleySenior DirectorThreat Analysis GroupTool of First Resort: Israel-Hamas War in Cyberhttps://blog.google/innovation-and-ai/technology/safety-security/tool-of-first-resort-israel-hamas-war-in-cyber/blue squares forming the abstract shape of an arrow set against a white background<img src="https://storage.googleapis.com/gweb-uniblog-publish-prod/images/TOFR_Keyword_Banner.max-600x600.format-webp.webp">An analysis of cyber operations in the Israel-Hamas War.Wed, 14 Feb 2024 00:01:00 +0000https://blog.google/innovation-and-ai/technology/safety-security/tool-of-first-resort-israel-hamas-war-in-cyber/Safety & SecurityThreat Analysis GrouparticleTool of First Resort: Israel-Hamas War in CyberAn analysis of cyber operations in the Israel-Hamas War.Googlehttps://blog.google/innovation-and-ai/technology/safety-security/tool-of-first-resort-israel-hamas-war-in-cyber/Sandra JoyceVP, Mandiant Intelligence - Google CloudShane HuntleySenior DirectorThreat Analysis GroupBuying Spying: How the commercial surveillance industry works and what can be done about ithttps://blog.google/threat-analysis-group/commercial-surveillance-vendors-google-tag-report/a blue square that reads "Threat Analysis Group"<img src="https://storage.googleapis.com/gweb-uniblog-publish-prod/images/BlogHero.max-600x600.format-webp.webp">This report documents the rise of commercial surveillance vendors and the industry that threatens free speech, the free press and the open internet.Tue, 06 Feb 2024 10:00:00 +0000https://blog.google/threat-analysis-group/commercial-surveillance-vendors-google-tag-report/Threat Analysis GrouparticleBuying Spying: How the commercial surveillance industry works and what can be done about itGooglehttps://blog.google/threat-analysis-group/commercial-surveillance-vendors-google-tag-report/Shane HuntleySenior DirectorThreat Analysis GroupTAG Bulletin: Q4 2023https://blog.google/threat-analysis-group/tag-bulletin-q4-2023/This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q4 2023. It was last updated on January 19, 2024.OctoberWe terminated 8 Y…Fri, 19 Jan 2024 20:00:00 +0000https://blog.google/threat-analysis-group/tag-bulletin-q4-2023/Threat Analysis GrouparticleTAG Bulletin: Q4 2023Googlehttps://blog.google/threat-analysis-group/tag-bulletin-q4-2023/Shane HuntleySenior DirectorThreat Analysis GroupRussian threat group COLDRIVER expands its targeting of Western officials to include the use of malwarehttps://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/an illustrated blue box with the phrase "Threat Analysis Group" in white<img src="https://storage.googleapis.com/gweb-uniblog-publish-prod/images/TAG_Fa6JTHm.max-600x600.format-webp.webp">Threat Analysis Group sheds light on Russian threat COLDRIVER’s use of malware.Thu, 18 Jan 2024 14:00:00 +0000https://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/Threat Analysis GrouparticleRussian threat group COLDRIVER expands its targeting of Western officials to include the use of malwareThreat Analysis Group sheds light on Russian threat COLDRIVER’s use of malware.Googlehttps://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/Wesley ShieldsThreat Analysis GroupZimbra 0-day used to target international government organizationshttps://blog.google/threat-analysis-group/zimbra-0-day-used-to-target-international-government-organizations/a blue box that reads "Threat Analysis Group"<img src="https://storage.googleapis.com/gweb-uniblog-publish-prod/images/TAG_rYhcbet.max-600x600.format-webp.webp">TAG’s discovery of a 0-day exploit used to steal email data from international government organizations.Thu, 16 Nov 2023 16:00:00 +0000https://blog.google/threat-analysis-group/zimbra-0-day-used-to-target-international-government-organizations/Threat Analysis GrouparticleZimbra 0-day used to target international government organizationsTAG’s discovery of a 0-day exploit used to steal email data from international government organizations.Googlehttps://blog.google/threat-analysis-group/zimbra-0-day-used-to-target-international-government-organizations/Clement Lecigne<department>Threat Analysis Group</department><company/></author><author xmlns:author="http://www.w3.org/2005/Atom"><name>Maddie Stone</name><title/><department>Threat Analysis Group</department><company/></author></item><item><title>Government-backed actors exploiting WinRAR vulnerabilityhttps://blog.google/threat-analysis-group/government-backed-actors-exploiting-winrar-vulnerability/Google's Threat Analysis Group analyzes recent state-sponsored campaigns exploiting the WinRAR vulnerability, CVE-2023-38831.Wed, 18 Oct 2023 15:00:00 +0000https://blog.google/threat-analysis-group/government-backed-actors-exploiting-winrar-vulnerability/Threat Analysis GrouparticleGovernment-backed actors exploiting WinRAR vulnerabilityGoogle's Threat Analysis Group analyzes recent state-sponsored campaigns exploiting the WinRAR vulnerability, CVE-2023-38831.Googlehttps://blog.google/threat-analysis-group/government-backed-actors-exploiting-winrar-vulnerability/Kate MorganThreat Analysis GroupTAG Bulletin: Q3 2023https://blog.google/threat-analysis-group/tag-bulletin-q3-2023/This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q3 2023. It was last updated on November 8, 2023.Thu, 05 Oct 2023 18:30:00 +0000https://blog.google/threat-analysis-group/tag-bulletin-q3-2023/Threat Analysis GrouparticleTAG Bulletin: Q3 2023Googlehttps://blog.google/threat-analysis-group/tag-bulletin-q3-2023/Shane HuntleySenior Director Threat Analysis Group0-days exploited by commercial surveillance vendor in Egypthttps://blog.google/threat-analysis-group/0-days-exploited-by-commercial-surveillance-vendor-in-egypt/Last week Google’s Threat Analysis Group (TAG), in partnership with The Citizen Lab, discovered an in-the-wild 0-day exploit chain for iPhones. Developed by the commerci…Fri, 22 Sep 2023 17:00:00 +0000https://blog.google/threat-analysis-group/0-days-exploited-by-commercial-surveillance-vendor-in-egypt/Threat Analysis Grouparticle0-days exploited by commercial surveillance vendor in EgyptGooglehttps://blog.google/threat-analysis-group/0-days-exploited-by-commercial-surveillance-vendor-in-egypt/Maddie Stone<department>Threat Analysis Group</department><company/></author></item></channel></rss>