Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Persistent Attempts at Cyberespionage Against Southeast Asian Government Target Have Links to Alloy Taurus

Summary: Unit 42 observed multiwave intrusions against a Southeast Asian government target from early 2022 through 2023, exploiting Exchange Server vulnerabilities to deploy web shells including China Chopper, and attributed the cluster, tracked as CL-STA-0045, to Alloy Taurus (GALLIUM) with moderate confidence. The attackers created administrative accounts named Admin$, Back$, infoma$ and testuser, attempted .NET backdoors named Reshell and Zapoa, installed SoftEther VPN renamed to Taskllst.exe, fonts.exe and vmtools.exe, and tried Cobalt Strike, Quasar RAT, HDoor, Gh0stCringe and a Winnti variant.

What's compelling: The group stayed inside a government network across two years and multiple waves, and even reused the AnyDesk password J9kzQ2Y0qO reported in Conti ransomware attacks - a reminder that a single unpatched Exchange server can become a long-term espionage foothold rather than a one-time breach.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026