Phantom Taurus: 新たな中華系Nexus APTとNET-STARマルウェア スイートの発見

Phantom Taurus is a previously undocumented nation-state APT whose activity aligns with PRC state interests, according to Unit 42 attribution framework. Over the past two and a half years, the group has targeted government and telecommunications organisations across Africa, the Middle East and Asia, focusing on ministries of foreign affairs, embassies, geopolitical events and military operations.

The researchers describe Phantom Taurus as espionage-focused, employing a distinctive set of TTPs and custom tools, including the NET-STAR malware suite. NET-STAR is a .NET malware suite designed to target Internet Information Services web servers and comprises three backdoors: IIServerCore, AssemblyExecuter V1 and AssemblyExecuter V2, the latter two adding AMSI and ETW bypass capabilities.

The group has evolved from primarily collecting emails to directly extracting data from databases via a script called mssq.bat, using Windows Management Instrumentation to run it on remote SQL Servers and export results to CSV. This evolution accompanies timestomping of web shells and backdoors to confound analyses.