China-linked APT Phantom Taurus uses Net-Star malware in espionage campaigns against key sectors

China-linked APT Phantom Taurus has targeted government and telecom organisations for espionage, using a previously undetected .NET malware suite called NET‑STAR to carry out in‑memory operations against internet‑facing IIS servers. The group, described as a Chinese APT, has operated in Africa, the Middle East and Asia for more than 2.5 years, with campaigns focusing on foreign ministries, embassies, geopolitical events and military operations.

The NET‑STAR toolset comprises three web backdoors—ISServerCore, AssemblyExecuter V1 and AssemblyExecuter V2—with V2 including AMSI and ETW bypass routines to operate in monitored environments; ISServerCore runs entirely in memory under the w3wp.exe process and uses Base64 payloads dropped by a web shell.

The authors note a tactical evolution from email‑centred operations to direct database targeting around early 2025, exploiting a script named mssq.bat to connect to SQL Server databases and export results to CSV via WMI. According to Palo Alto Networks, this group’s distinctive modus operandi and advanced practices set Phantom Taurus apart from other Chinese APTs.