New China-Linked Hacker Group Hits Governments With Stealth Malware

Sep 30, 2025Ravie LakshmananCyber Espionage / Malware

Authorities and telecommunications organizations throughout Africa, the Center East, and Asia have emerged because the goal of a beforehand undocumented China-aligned nation-state actor dubbed Phantom Taurus over the previous two-and-a-half years.

“Phantom Taurus’ primary focus areas embody ministries of overseas affairs, embassies, geopolitical occasions, and army operations,” Palo Alto Networks Unit 42 researcher Lior Rochberger stated. “The group’s main goal is espionage. Its assaults reveal stealth, persistence, and a capability to shortly adapt their ways, strategies, and procedures (TTPs).”

It is price stating that the hacking group was first detailed by the cybersecurity firm again in June 2023 underneath the moniker CL-STA-0043. Then final Might, the risk cluster was graduated to a brief group, TGR-STA-0043, following revelations about its sustained cyber espionage efforts geared toward governmental entities since at the very least late 2022 as a part of a marketing campaign codenamed Operation Diplomatic Specter.

Unit 42 stated its continued commentary of the group yielded sufficient proof to categorise it as a brand new risk actor whose main objective is to allow long-term intelligence assortment and acquire confidential information from targets which can be of strategic curiosity to China, each economically and geopolitically.

“The group takes an curiosity in diplomatic communications, defense-related intelligence and the operations of important governmental ministries,” the corporate stated. “The timing and scope of the group’s operations incessantly coincide with main international occasions and regional safety affairs.”

This facet is especially revealing, not least as a result of different Chinese language hacking teams have additionally embraced an analogous strategy. As an example, a brand new adversary tracked by Recorded Future as RedNovember is assessed to have focused entities in Taiwan and Panama in shut proximity to “geopolitical and army occasions of key strategic curiosity to China.”

Phantom Taurus’ modus operandi additionally stands out as a consequence of the usage of custom-developed instruments and strategies not often noticed within the risk panorama. This features a never-before-seen bespoke malware suite dubbed NET-STAR. Developed in .NET, this system is designed to focus on Web Info Companies (IIS) internet servers.

That stated, the hacking crew has relied on shared operational infrastructure that has been beforehand employed by teams like AT27 (aka Iron Taurus), APT41 (aka Starchy Taurus or Winnti), and Mustang Panda (aka Stately Taurus). Conversely, the infrastructure parts utilized by the risk actor haven’t been detected in operations carried out by others, indicating some form of “operational compartmentalization” inside the shared ecosystem.

The precise preliminary entry vector shouldn’t be clear, however prior intrusions have weaponized susceptible on-premises Web Info Companies (IIS) and Microsoft Alternate servers, abusing flaws like ProxyLogon and ProxyShell, to infiltrate goal networks.

“To this point now we have seen them exploiting recognized vulnerabilities for IIS and Microsoft Alternate servers (comparable to ProxyLogon and ProxyShell), however that does not imply it received’t change sooner or later,” Assaf Dahan, director of risk analysis at Unit 42, instructed The Hacker Information. “The group may be very resourceful and motivated – they are going to discover a manner in a method or one other.”

One other important aspect of the assaults is the shift from gathering emails to the direct focusing on of databases utilizing a batch script that makes it attainable to connect with an SQL Server database, export the ends in the type of a CSV file, and terminate the connection. The script is executed utilizing the Home windows Administration Instrumentation (WMI) infrastructure.

Unit 42 stated the risk actor used this methodology to methodically seek for paperwork of curiosity and data associated to particular international locations comparable to Afghanistan and Pakistan.

Current assaults mounted by Phantom Taurus have additionally leveraged NET-STAR, which consists of three web-based backdoors, every of which performs a selected operate whereas sustaining entry to the compromised IIS atmosphere –

• IIServerCore, a fileless modular backdoor loaded by way of an ASPX internet shell that helps in-memory execution of command-line arguments, arbitrary instructions, and payloads, and transmits the ends in an encrypted command-and-control (C2) communication channel
• AssemblyExecuter V1, which hundreds and executes extra .NET payloads in reminiscence
• AssemblyExecuter V2, an enhanced model of AssemblyExecuter V1 that additionally comes fitted with the power to bypass Antimalware Scan Interface (AMSI) and Occasion Tracing for Home windows (ETW)

“The NET-STAR malware suite demonstrates Phantom Taurus’ superior evasion strategies and a deep understanding of .NET structure, representing a major risk to internet-facing servers,” Unit 42 stated. “IIServerCore additionally helps a command known as changeLastModified. This implies that the malware has lively timestomping capabilities, designed to confuse safety analysts and digital forensics instruments.”