Unit 42 Researchers Discover Multiple Espionage Operations Targeting Southeast Asian Government
Summary: Unit 42 researchers investigating espionage attacks on a Southeast Asian government found the activity split into three distinct clusters attributed to separate APT groups: Stately Taurus (moderate-high confidence), Alloy Taurus and Gelsemium (both moderate confidence). The clusters used different tools and infrastructure - Stately Taurus deployed a ToneShell variant and ShadowPad, Alloy Taurus used previously unknown backdoors Zapoa and ReShell, and Gelsemium targeted vulnerable IIS servers with OwlProxy and SessionManager - with activity dating back to early 2021.
Why it matters: Three separate APT groups ran espionage operations against the same government's critical infrastructure, healthcare and finance entities, sometimes simultaneously on the same machines, and the activity spans from 2021 into the present year.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026