Loading story…
Security researchers analyzed the attribution of Chinese state-sponsored cyber operations, focusing on the complexities introduced by overlapping APT groups and the involvement of Chinese technology companies. The Natto Thoughts blog discussed the connections between Salt Typhoon and several Chinese companies identified in a joint cybersecurity advisory, highlighting the difficulties in attributing cyber operations due to shared suppliers and operational overlaps with groups like OPERATOR PANDA and GhostEmperor. Separately, Palo Alto Networks' Unit 42 detailed the use of the Bookworm malware by the Chinese APT group Stately Taurus, demonstrating how structured attribution frameworks can link specific malware to threat actors and improve confidence in identifying adversary tradecraft. Both sources underscore the evolving landscape of Chinese cyber espionage and the analytical challenges in accurately attributing threat activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
3 references tracked. Mallory keeps watching after this page renders.
unit42.paloaltonetworks.com
Open sourcenattothoughts.substack.com
Open sourceapps.dtic.mil
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
State-backed advanced persistent threat (APT) groups have intensified their cyber espionage activities, employing increasingly sophisticated tactics, techniques, and procedures (TTPs) to infiltrate and persist within high-value targets. APT15, believed to operate out of China, has conducted a series of high-profile campaigns targeting government entities, defense contractors, and minority groups across Europe, North America, and Asia. Their operations leverage spear phishing, exploitation of public-facing applications, and advanced defense evasion methods such as steganography and masquerading malware as legitimate software. Similarly, the Iranian group Charming Kitten (APT35) has been exposed through recent leaks, revealing the identities of key personnel, financial structures, and thousands of compromised systems worldwide. These leaks detail how the group uses spear-phishing, fake login pages, and malicious attachments to gain initial access, followed by persistent surveillance and data exfiltration from government, academic, and civil society networks. Technical analysis of these groups' operations highlights the use of legitimate system tools for lateral movement and persistence, as well as complex command-and-control (C2) infrastructures designed to evade detection. The leaks concerning Charming Kitten provide unprecedented insight into the operational management and financial underpinnings of Iranian cyber espionage, including the use of front companies and detailed tasking sheets. Both APT15 and APT35 demonstrate the ongoing evolution of state-sponsored cyber threats, with a focus on stealth, persistence, and the targeting of sensitive information across multiple sectors and geographies.
Jun 29, 2026
Phantom Taurus, a newly identified advanced persistent threat (APT) group linked to the People’s Republic of China, has been conducting extensive cyber espionage operations over the past two and a half years. The group has primarily targeted government and telecommunications organizations across Africa, the Middle East, and Asia, focusing on ministries of foreign affairs, embassies, and entities involved in geopolitical and military affairs. Phantom Taurus is distinguished by its use of highly covert tactics, techniques, and procedures (TTPs) that enable it to maintain persistent, long-term access to sensitive networks. The group’s primary objective is intelligence gathering, with a particular interest in diplomatic communications, defense-related information, and the operations of critical governmental ministries. Researchers from Palo Alto Networks Unit 42 first observed this activity cluster in June 2023, initially tracking it as CL-STA-0043. In May 2024, the cluster was promoted to a temporary group, TGR-STA-0043, under the campaign name Operation Diplomatic Specter, reflecting the sustained and sophisticated nature of the attacks. Continued investigation and intelligence collection led to the formal classification of Phantom Taurus as a distinct threat actor, based on a rigorous attribution framework. One of the group’s notable tools is NET-STAR, a previously undocumented custom malware suite designed for stealthy operations and long-term persistence. The timing and scope of Phantom Taurus’ operations often align with major global and regional security events, suggesting a strategic intent to support Chinese state interests. The group’s ability to rapidly adapt its TTPs has allowed it to evade detection and maintain access to high-value targets. Phantom Taurus’ campaigns are characterized by their focus on espionage rather than financial gain or disruption. The group’s activities have provided China with access to confidential data of strategic economic and geopolitical value. The discovery of Phantom Taurus and its NET-STAR malware suite highlights the evolving landscape of Chinese cyber espionage and the increasing sophistication of state-sponsored threat actors. The group’s operations underscore the need for heightened vigilance and advanced defensive measures among government and telecommunications organizations in the targeted regions. The identification and public disclosure of Phantom Taurus mark a significant development in the understanding of Chinese cyber operations. Security researchers emphasize the importance of continued monitoring and intelligence sharing to counter the persistent threat posed by Phantom Taurus and similar APT groups. The campaign demonstrates the ongoing risk to critical infrastructure and sensitive government communications from nation-state actors employing advanced malware and covert techniques.
Jun 29, 2026
Salt Typhoon, a Chinese state-linked advanced persistent threat (APT) group, attempted to infiltrate a European telecommunications organization by exploiting a vulnerability in a Citrix NetScaler Gateway appliance. The attack was first detected by Darktrace in July 2025, when threat activity consistent with Salt Typhoon’s known tactics, techniques, and procedures (TTPs) was observed. The group, also known as Earth Estries, GhostEmperor, and UNC2286, has a history of targeting telecoms and digital infrastructure globally, with previous campaigns against U.S. telecoms and ongoing interest in European targets. Initial access was achieved through the exploitation of the Citrix NetScaler Gateway, a method frequently used by Salt Typhoon to compromise network equipment. After breaching the gateway, the attackers moved laterally within the organization, targeting Citrix Virtual Delivery Agent hosts in the Machine Creation Services (MCS) subnet. The group deployed the SNAPPYBEE (also known as Deed RAT) backdoor, a tool commonly shared among Chinese APT groups, to establish command and control (C2) within the compromised environment. The C2 infrastructure utilized LightNode VPS endpoints and communicated over both HTTP and an unidentified TCP-based protocol, demonstrating the group’s use of non-standard and layered protocols to evade detection. To maintain stealth and persistence, Salt Typhoon employed DLL sideloading techniques, delivering malicious DLLs alongside legitimate antivirus executables such as Norton Antivirus, Bkav Antivirus, and IObit Malware Fighter. This allowed the attackers to execute their payloads under the guise of trusted software, bypassing traditional security controls. The group’s tactics included abusing legitimate software for stealth and execution, a hallmark of their operations. Darktrace analysts noted that the pattern of activity closely matched Salt Typhoon’s previous campaigns, reinforcing attribution to the group. The intrusion was detected before the attackers could achieve deeper compromise or exfiltrate sensitive data, highlighting the importance of proactive threat detection. The incident underscores the persistent threat posed by Chinese cyberespionage actors to the telecommunications sector, particularly through the exploitation of known vulnerabilities in widely used network appliances. The Five Eyes intelligence alliance and other international partners have previously warned about Salt Typhoon’s global targeting of communications infrastructure. The group’s operations are believed to be conducted by private hacking firms contracted by Chinese government agencies, as revealed by earlier data leaks. The attempted breach demonstrates the evolving sophistication of state-sponsored cyber operations and the need for robust security measures in critical infrastructure sectors. The use of advanced lateral movement, stealthy persistence mechanisms, and shared malware tools reflects the group’s technical capabilities. The incident also highlights the value of threat intelligence sharing and rapid response in mitigating nation-state cyber threats. Ongoing monitoring and patching of network equipment vulnerabilities remain essential defenses against such targeted attacks. The European telecom’s timely detection and response prevented further escalation and potential operational impact. This event adds to the growing body of evidence regarding Salt Typhoon’s focus on global telecommunications espionage.
Jun 29, 2026