Phantom Taurus: New Chinese APT Emerges with Fileless NET-STAR Backdoor Targeting Global Governments and Telecoms

According to Unit 42, Phantom Taurus is a previously undocumented Chinese state-aligned threat actor whose espionage operations have been active for more than two years and target government and telecommunications organisations across Africa, the Middle East and Asia, with a focus on foreign affairs, embassies and military operations.

The group is said to employ rare custom-developed tools, including the Specter malware family, Ntospy and a newly discovered NET-STAR malware suite, described as a fileless backdoor ecosystem designed to compromise Microsoft IIS web servers. NET-STAR comprises three components, including IIServerCore, a modular backdoor that operates entirely in memory, and two AssemblyExecuter variants that load additional .NET payloads in memory, with V2 adding AMSI and ETW bypass capabilities for stealth.

The campaign has shifted in early 2025 to directly targeting databases and uses a malicious script named mssq.bat to query, extract and export results from SQL databases using stolen administrator credentials. Phantom Taurus also employs timestomping and other file metadata manipulation to hinder forensic investigations.