Stately Taurus Targets the Philippines As Tensions Flare in the South Pacific
Summary: Unit 42 observed three Stately Taurus campaigns in August 2023 targeting entities in the South Pacific, including the Philippines government, using renamed copies of Solid PDF Creator and the Indonesian antivirus SmadavProtect to side-load malicious DLLs. The malware called home to 45.121.146[.]113 while setting the host field to wcpstatic.microsoft[.]com to mimic legitimate Microsoft traffic, and Unit 42 identified connections from Philippines government infrastructure to that C2 server between Aug. 10 and Aug. 15, 2023.
Why it matters: A Chinese APT assessed to have operated since at least 2012 held a foothold in Philippines government infrastructure for five days in August 2023, during a period of open maritime confrontation - and the only tell was traffic to a known malicious IP dressed up as Microsoft.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026