Chinese APT Abuses VSCode to Target Government in Asia
Summary: Unit 42 researchers report that Stately Taurus, a Chinese APT group operating since at least 2012, abused Visual Studio Code's embedded reverse shell feature to gain footholds in government networks in Southeast Asia, the first observed in-the-wild use of a technique described in a September 2023 Medium post. The group used the code.exe tunnel command to connect a VSCode web session to compromised machines, created persistence via a scheduled task running startcode.bat, and exfiltrated data by archiving drives with rar.exe over SMB and uploading to Dropbox via curl.
Key Takeaway: The tool abused here is a legitimate developer application that many organizations install and few restrict, and the same environment also hosted a simultaneous ShadowPad backdoor cluster that Unit 42 could not definitively tie to Stately Taurus as of mid-August 2024.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026