Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda
Summary: Unit 42 assessed with moderate-high confidence that Stately Taurus, also known as Mustang Panda, ran cyberespionage intrusions against a Southeast Asian government from at least Q2 2021 through Q3 2023, tracked as CL-STA-0044, exfiltrating sensitive documents from compromised networks. The actor used an undocumented three-DLL variant of the ToneShell backdoor loaded via DLL sideloading, abused ESET's Remote Administrator Agent, deployed ShadowPad and Cobalt Strike, and exfiltrated archived files through curl and ftp to ftp.1fichier[.]com and to Dropbox.
What's compelling: The actor used wevtutil to read Windows Security Log events 4624 and 4672 to identify which machines specific government users of interest logged in to, then compromised those hosts and set an autorun.vbs script to archive files on every startup - a continuous intelligence flow rather than a one-time theft. Exfiltration through Dropbox and a public file-hosting site means the outbound traffic looked like ordinary employee file sharing.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026