Phantom Taurus: A New Chinese Nexus APT and the Discovery of the NET-STAR Malware Suite
Summary: Unit 42 has formally designated Phantom Taurus, a previously undocumented China-aligned APT it had tracked since June 2023 as cluster CL-STA-0043 and later as temporary group TGR-STA-0043, after two and a half years of observing espionage against government and telecommunications targets across Africa, the Middle East and Asia. The group has shifted from stealing emails off mail servers to pulling data directly from databases via a WMI-executed script named mssq.bat, and now deploys a previously undocumented .NET malware suite called NET-STAR against Internet Information Services web servers.
Bottom line: NET-STAR's main backdoor runs entirely in memory inside the IIS worker process, and its AssemblyExecuter component drew minimal antivirus flagging on VirusTotal at the time of publication - so the internet-facing servers in your estate may be hosting an implant your endpoint tools were never positioned to see.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026