BOOKWORM TO STATELY TAURUS USING THE UNIT 42 ATTRIBUTION FRAMEWORK

Summary from the TLDR InfoSec newsletter

Palo Alto Networks' Unit 42 linked the Bookworm malware family to the Chinese APT group Stately Taurus by analyzing shared artifacts, including PDB paths, infrastructure, and targeting of Southeast Asian governments. Using the Admiralty System, they scored evidence reliability, reaching a confidence score of 58.4 based on toolsets, victim profiles, timelines from 2015-2022, and environment fingerprints. This case shows how structured attribution enables evidence-based threat actor identification, improving cybersecurity intelligence.