PHANTOM TAURUS: A NEW CHINESE NEXUS APT AND THE DISCOVERY OF THE NET-STAR MALWARE SUITE

Summary from the TLDR InfoSec newsletter

Phantom Taurus is a Chinese state-sponsored APT group targeting government and telecom organizations across Africa, the Middle East, and Asia for espionage aligned with PRC interests. Evolving from email attacks to database targeting, it utilizes custom tools like the NET-STAR malware suite, which includes three fileless .NET backdoors (IIServerCore, AssemblyExecuter V1/V2), to compromise IIS web servers. It employs evasion tactics such as AMSI and ETW bypasses. Security teams should watch for TTPs such as timestomping, fileless execution within w3wp.exe, and ASPX web shells, including OutlookEN.aspx, while managing threat exposure to detect infrastructure sharing among Chinese APT groups.