Phantom Taurus: New China-Linked Hacker Group Hits Governments With Stealth Malware

""Phantom Taurus' main focus areas include ministries of foreign affairs, embassies, geopolitical events, and military operations," Palo Alto Networks Unit 42 researcher Lior Rochberger said."

""The group's primary objective is espionage. Its attacks demonstrate stealth, persistence, and an ability to quickly adapt their tactics, techniques, and procedures (TTPs).""

""The group takes an interest in diplomatic communications, defense-related intelligence and the operations of critical governmental ministries," the company said."

""The timing and scope of the group's operations frequently coincide with major global events and regional security affairs.""

Phantom Taurus is a China-aligned nation-state cyber actor targeting government and telecommunications organizations across Africa, the Middle East, and Asia over the past two-and-a-half years. The actor focuses on ministries of foreign affairs, embassies, geopolitical events, military operations, diplomatic communications, and defense-related intelligence to enable long-term intelligence collection and obtain confidential strategic data. The group operates with stealth, persistence, and rapid adaptation of tactics, techniques, and procedures. The actor was previously tracked as CL-STA-0043 and later TGR-STA-0043 during Operation Diplomatic Specter, with operations often timed around major global and regional security events, resembling other China-aligned espionage campaigns.

Read at The Hacker News