New Chinese Nexus APT Group Targeting Organizations to Deploy NET-STAR Malware Suite

Phantom Taurus, a China-linked advanced persistent threat (APT) group, has intensified espionage operations across Africa, the Middle East and Asia, deploying a newly discovered .NET malware suite named NET-STAR. First tracked by Unit 42 in June 2023 as cluster CL-STA-0043 and later designated TGR-STA-0043 (Operation Diplomatic Specter) in May 2024, the group is now formally mature as a distinct threat actor aligned with PRC state interests.

Over the past two and a half years, campaigns have repeatedly targeted ministries of foreign affairs, embassies, and entities involved in geopolitical events and military operations, with victimology aligning to PRC strategic priorities.

NET-STAR comprises three .NET-based components, including IIServerCore, a modular backdoor running in memory, and two loader variants that execute in memory and bypass detection, with V2 adding AMSI and ETW evasion; the malware uses a web shell OutlookEN.aspx and timestomping to evade forensic analysis. In early 2025, the group shifted to direct database exfiltration via a custom script called mssq.bat, using stolen credentials to reach SQL Server instances and export results to CSV files.

According to Unit 42, some of Phantom Taurus’ infrastructure overlaps with Iron Taurus, Starchy Taurus, and Stately Taurus, underscoring a specialized operational segment within the broader Chinese nexus; Palo Alto Networks customers are advised to employ protections such as WildFire, Advanced Threat Prevention, Cortex XDR, and XSIAM.