Phantom Taurus

Phantom Taurus is a previously undocumented China-aligned, PRC state-interest-aligned nation-state espionage actor identified by Palo Alto Networks Unit 42. Unit 42 reported the group has operated for roughly two and a half years, targeting government and telecommunications organizations across Africa, the Middle East, and Asia. Reported targeting includes ministries of foreign affairs, embassies, diplomats, foreign ministries, and entities connected to geopolitical events, military operations, diplomatic communications, defense-related intelligence, and critical governmental ministry operations. The group’s primary objective is espionage and long-term intelligence collection of sensitive, non-public information. Unit 42 tracked this activity previously as CL-STA-0043, later promoted it to temporary group TGR-STA-0043 under the campaign name Operation Diplomatic Specter, and then elevated it to the distinct threat group Phantom Taurus. Unit 42 assessed Phantom Taurus uses a shared Chinese APT operational infrastructure ecosystem also associated with Iron Taurus (APT27), Starchy Taurus (Winnti), and Stately Taurus (Mustang Panda), while also maintaining compartmentalized infrastructure components not observed in other actors’ operations. Observed tooling includes China Chopper, the Potato suite, and Impacket, as well as customized tooling including the Specter malware family, Ntospy, and the NET-STAR malware suite. NET-STAR is a .NET malware suite targeting IIS web servers and includes three web-based backdoors: IIServerCore, AssemblyExecuter v1, and AssemblyExecuter v2. Reported characteristics include fileless and in-memory execution within w3wp.exe, encrypted C2, cookie-based session handling, loading via the OutlookEN.aspx web shell, timestomping, and AMSI and ETW bypass capabilities in AssemblyExecuter v2. Unit 42 reported Phantom Taurus initially focused on compromising Microsoft Exchange and stealing targeted emails, then evolved in early 2025 toward direct database theft. In that shift, the group used a batch script named mssq.bat, executed remotely via WMI, to authenticate to SQL Server using previously obtained credentials, run operator-supplied queries, and export results to CSV for exfiltration. Reported searches included information related to Afghanistan and Pakistan. The group is described as stealthy, persistent, and adaptive, with operations often coinciding with major global events and regional security affairs.