Bookworm to Stately Taurus Using the Unit 42 Attribution Framework
Summary: Unit 42 used its Attribution Framework to link the Bookworm malware family to Stately Taurus, a Chinese APT group active since at least 2012 that runs cyberespionage campaigns against government and commercial entities in Europe and Asia. The case rests on shared technical artifacts, including a PDB path (C:\Users\hack\Documents\WhiteFile\LTDIS13n\Release\LTDIS13n.pdb) found in both Bookworm and ToneShell samples compiled eight weeks apart, shared C2 infrastructure such as IPs 103.27.202[.]68 and 103.27.202[.]87, and overlapping victimology in Southeast Asian governments.
What's compelling: Unit 42 says the overlaps let it attribute previously unattributed attacks on Southeast Asian governments to Stately Taurus going back nine years - meaning activity that sat unassigned in defenders' records may now belong to a known APT with a documented toolset.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026