Chinese APT ‘Phantom Taurus’ Targeting Organizations With Net-Star Malware

A Chinese state-sponsored hacking group tracked as Phantom Taurus has been targeting government and telecommunications organisations for espionage for more than two years, according to SecurityWeek’s coverage of Palo Alto Networks’ findings. Initially observed in 2023, the APT is now linked to Chinese hacking groups through shared infrastructure, but its tactics, techniques and procedures differ from those typically associated with Chinese actors.

In 2025 the group began using Net-Star, a .NET malware suite targeting IIS web servers, which comprises three web-based backdoors: IIServerCore, AssemblyExecuter V1 and AssemblyExecuter V2, the latter with enhanced evasion capabilities for AMSI and ETW. The IIServerCore backdoor operates in memory and can receive and execute payloads, sending results to its C2 server, while AssemblyExecuter variants load and run additional code in memory.

Security researchers note that Phantom Taurus has targeted email servers to exfiltrate messages and databases, focusing on high‑value organisations such as ministries of foreign affairs and embassies, with activity seen in Africa, the Middle East and Asia. We observed that the group takes an interest in diplomatic communications and defence-related intelligence, and that its operations often align with major global events, according to Palo Alto Networks.