Bookworm to Stately Taurus Using the Unit 42 Attribution Framework

According to Unit 42 Attribution Framework, the article traces how Bookworm malware is linked to the Stately Taurus threat group through a systematic, evidence-based analysis. The piece notes that Stately Taurus is a Chinese APT active since at least 2012, with Bookworm first observed in 2015 as an advanced RAT used in espionage campaigns.

It highlights several corroborating factors, including shared PDB paths such as C:\Users\hack\Documents\WhiteFile\LTDIS13n\Release\LTDIS13n[.]pdb, common shellcode loading techniques, and overlapping infrastructure used by Bookworm and ToneShell, alongside the use of Impacket in Bookworm-related incidents.

The article cites specific infrastructure overlaps, including IP addresses 103.27.202[.]68 and 103.27.202[.]87 and domains such as update.fjke5oe[.]com and www.hbsanews[.]com, to illustrate a unified operational control by Stately Taurus. Published on 24 September 2025, the piece concludes with a high confidence attribution score of 58.4 within the framework, underscoring the robustness of the methodology.