New China APT Strikes With Precision and Persistence

A previously undocumented Chinese nation-state actor is targeting government agencies, embassies, military operations and other entities across Africa, the Middle East and Asia in a cyber-espionage operation described as highly sophisticated, with the group going after high-value systems rather than relying on end-user social engineering.

Phantom Taurus is characterised by surgical precision and unprecedented persistence, rarely going dark for long and resurfacing within hours or days to maintain access, according to Unit 42. Initially, the group infiltrated email servers to exfiltrate messages, but more recently has begun targeting databases directly, using the script mssq.bat to connect to SQL Server databases with stolen systems administrator credentials and exporting matching results.

In addition, Unit 42 found a new .NET malware suite, tracked as NET-STAR, to breach IIS Web servers, where a fileless backdoor called IIServerCore operates in memory and can execute arbitrary code while encrypting C2 sessions and loading additional payloads with AssemblyExecuter loaders.

The tooling includes AMSI and ETW bypass capabilities, and the campaign shows overlaps with other China-linked groups such as Iron Taurus, Starchy Taurus and Mustang Panda, with many C2 IPs and domains sharing common infrastructure. according to Unit 42.