Loading threat actor…
Phantom Taurus is a China-aligned espionage threat actor assessed to operate in support of People’s Republic of China state interests. The group has conducted long-term intelligence collection for at least roughly two and a half years, primarily targeting government and telecommunications organizations across Africa, the Middle East, and Asia. Its targeting has included ministries of foreign affairs, embassies, diplomatic communications, defense-related intelligence, military operations, and critical government ministry activity, with operations often coinciding with major geopolitical events and regional security developments. The actor has also targeted service providers and technology environments that enable access to government information. The activity was previously tracked as CL-STA-0043 and later as TGR-STA-0043 under the campaign name Operation Diplomatic Specter before being elevated to a distinct threat group. Kroll tracks the actor as KTA516. Phantom Taurus shares elements of a broader Chinese operational infrastructure ecosystem associated with groups such as APT27, Winnti, and Mustang Panda, while maintaining compartmentalized infrastructure and tooling that distinguish it from those clusters. Phantom Taurus is characterized by stealth, persistence, and adaptive tradecraft. Reported tooling includes common post-compromise utilities such as China Chopper, the Potato suite, and Impacket, alongside customized malware including the Specter malware family, Ntospy, and the NET-STAR malware suite. NET-STAR is a .NET malware framework targeting IIS servers and includes multiple web-based backdoors designed for in-memory execution, encrypted command-and-control, web-shell-based loading, and anti-forensic measures such as timestomping. Newer variants include AMSI and ETW bypass capabilities to reduce visibility to security tooling. Operationally, Phantom Taurus has been observed compromising internet-facing server infrastructure, including IIS and Microsoft Exchange environments, and maintaining long-term access for espionage. The group historically focused on collecting sensitive emails from compromised mail servers, then evolved in early 2025 toward direct database theft by remotely executing scripts via WMI to query SQL Server instances and export results for exfiltration. This shift, combined with extensive use of living-off-the-land techniques and memory-resident malware, reflects a mature intrusion capability focused on covert collection of sensitive, non-public information.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
9 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
14 malware families attributed to this actor across reporting.
9 additional families tracked in Mallory.
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
"...prior intrusions have weaponized vulnerable on-premises Internet Information Services (IIS) and Microsoft Exchange servers, abusing flaws like ProxyLogon and ProxyShell, to infiltrate target networks."
"...prior intrusions have weaponized vulnerable on-premises Internet Information Services (IIS) and Microsoft Exchange servers, abusing flaws like ProxyLogon and ProxyShell, to infiltrate target networks."
4 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Targeting African government and related service providers, with emphasis on diplomatic communications, defense intelligence, and critical ministry operations.
Phantom Taurus is a Chinese nation-state threat actor conducting cyber-espionage campaigns targeting high-value government and military entities in Africa, the Middle East, and Asia, using custom toolkits.
Chinese nexus APT conducting long-term espionage against government and telecommunications sectors using the NET-STAR malware suite.
Named APT/activity cluster described as a China-linked nexus, associated with discovery/use of the NET-STAR malware suite.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.