Chinese Playful Taurus Activity in Iran
Summary: Unit 42 reports that Playful Taurus (APT15, also tracked as BackdoorDiplomacy, Vixen Panda, KeChang and NICKEL), a Chinese APT active since at least 2010, has likely compromised several Iranian government networks, based on four Iranian organizations connecting daily to the C2 IP 152.32.181[.]16 between July and late December 2022. The group's Turian backdoor has been updated with a new C2 decryption algorithm and a network protocol built on the Security Support Provider Interface (SSPI), and a Turian sample named dellux.exe was uploaded to VirusTotal from submitters in Iran on Nov. 12 and 13, 2022.
Key Takeaway: The C2 IP the Iranians connected to carried an expired Senegal Ministry of Foreign Affairs certificate that, after expiring in April 2021, was associated with nine IPs, eight of which hosted Playful Taurus domains - a reminder that a single stale certificate can anchor years of espionage infrastructure.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026