Phantom Taurus: New China-Linked Hacker Group Hits Governments With Stealth Malware

Phantom Taurus is a China-aligned nation-state actor described by Unit 42 as targeting governments and telecommunications organisations across Africa, the Middle East and Asia with stealth malware. The group’s main focus includes ministries of foreign affairs, embassies, geopolitical events, and military operations, with espionage as its primary objective and a demonstrated ability to adapt TTPs.

It was first detailed in June 2023 as CL-STA-0043 and later reclassified in May 2024 as TGR-STA-0043, with observations indicating ongoing government-focused espionage since at least late 2022. According to Unit 42, the threat actor uses a bespoke NET-STAR malware suite comprising three web-based backdoors to maintain access to IIS environments, including IIServerCore, AssemblyExecuter V1, and AssemblyExecuter V2, the latter capable of bypassing AMSI and ETW.

Initial access has involved weaponising vulnerable on-premises IIS and Microsoft Exchange servers, exploiting ProxyLogon and ProxyShell flaws to infiltrate networks. Recent operations shifted from harvesting emails to targeting databases with a batch script that exports CSV data via Windows Management Instrumentation to locate documents of interest related to countries such as Afghanistan and Pakistan.

The group shares operational infrastructure with other China-linked actors like AT27, APT41 and Mustang Panda, though components appear compartmentalised within the ecosystem.