When a senior diplomatic summit is imminent, Phantom Taurus is likely already inside the relevant ministry’s email infrastructure. That’s the operational picture Unit 42 documented across two and a half years of sustained collection: a Chinese state-aligned APT with a bespoke malware suite, exceptional operational security, and a targeting list that reads like a map of Beijing’s strategic interests.
The group was operating unattributed from at least mid-2022 until Unit 42’s disclosure in late 2025. Long dwell time, continuous collection, no public attribution. That’s how it’s supposed to work when you’re good at this.
Where Phantom Taurus Fits in the Chinese APT Ecosystem
The Chinese APT landscape is crowded with overlapping groups sharing infrastructure, tooling, and tasking from the same sponsoring authorities. Phantom Taurus sits within that ecosystem. Unit 42 identified operational infrastructure overlaps with Iron Taurus (APT27), Starchy Taurus (Winnti/APT41), and Stately Taurus (Mustang Panda), but it operates as a distinct cluster with its own custom capability set and its own targeting brief.
The targets tell the story. Foreign affairs ministries. Embassies and diplomatic missions. Military-affiliated organisations. Telecommunications providers. Concentrated in Sub-Saharan and North Africa, the Middle East, and South and Southeast Asia: regions where China’s Belt and Road commitments, energy security interests, and monitoring of Western diplomatic activity all converge.
Attribution to China rests on the usual pillars: shared infrastructure with known PRC-nexus actors, tooling exclusive to Chinese APT operations, targeting patterns directly aligned with PRC collection priorities, and behavioural indicators consistent with Chinese government working hours. None of those alone is definitive. Together they’re compelling.
The NET-STAR Malware Suite: Built for Staying Invisible
Phantom Taurus’s signature capability is a custom malware family, NET-STAR, purpose-built for Microsoft IIS environments. Three components, each designed for a specific role in the intrusion lifecycle.
IIServerCore is the foundation: a fileless, modular backdoor that executes entirely in memory. No files written to disk. Minimal forensic artefacts. It supports in-memory execution of command-line arguments, arbitrary OS commands, and additional payloads operators want to run post-compromise. The decision to operate entirely in memory is a deliberate anti-forensics choice: it defeats most file-based detection mechanisms and complicates incident response significantly when it’s eventually discovered.
AssemblyExecuter V1 extends the footprint. It loads and executes additional .NET payloads entirely within memory, allowing operators to expand capability on a compromised system without dropping executables to disk. Think of it as a framework for post-access capability expansion with minimal detection surface.
AssemblyExecuter V2 is where the operational sophistication becomes clearest. This version adds bypass mechanisms for two specific Windows defensive capabilities: the Antimalware Scan Interface (AMSI) and Event Tracing for Windows (ETW). AMSI bypass prevents Windows Defender and compatible AV from inspecting memory-resident scripts and payloads. ETW bypass blinds security monitoring tools that rely on kernel-level event tracing for behaviour detection. The 2025 update to V2 refined these techniques, which tells you that earlier versions were being blocked, and the developers responded. Active development, adapting to defender improvements. That’s a serious capability programme.
How They Move Through an Environment
Initial access comes through internet-facing IIS server vulnerabilities. Not phishing; the server layer. This is a deliberate choice: IIS-based footholds provide high-privilege entry directly into server infrastructure, bypassing email security controls entirely and landing in an environment that’s typically less monitored than endpoint space.
From an IIS foothold, Phantom Taurus uses Windows Management Instrumentation (WMI) for remote code execution and lateral movement, abusing legitimate Windows infrastructure in a way that generates minimal distinctive artefacts. WMI-based lateral movement is detectable with the right telemetry. Without it, it’s nearly invisible.
A custom tool designated Net Crawler handles credential dumping, SMB brute force against adjacent systems, and lateral movement via PsExec. It functions as a worm-like propagation component, working outward from the initial IIS foothold toward higher-value targets deeper in the network.
Beyond NET-STAR, the group deploys China Chopper web shells for persistent server access, the Specter malware family for post-compromise operations, Ntospy for Windows authentication credential harvesting, and the Potato suite for privilege escalation. Off-the-shelf tools where detection risk is acceptable; custom capability at the most sensitive stages. That balance is itself a marker of operational maturity.
What They’re After
The targeting priorities are specific. Foreign affairs ministries are the highest-value category, providing access to diplomatic cable traffic, negotiating positions, personnel information, and bilateral relationship intelligence. When Phantom Taurus is inside a foreign ministry ahead of a major negotiation, the intelligence value is substantial and immediate.
Embassies and diplomatic missions are secondary targets: satellite offices that often carry weaker security postures than parent ministries while still handling sensitive communications. Embassy compromise provides intelligence on both the host country and the represented nation simultaneously.
Military-affiliated organisations (defence procurement entities, joint exercise coordinators, military-to-military relationship managers) appear consistently in the targeting set, consistent with PRC defence intelligence collection priorities.
Telecom providers round out the list. Telecom access provides persistent, passive visibility into communications metadata and sometimes content, complementing the intelligence from government ministry access and covering the communications layer that ministry networks don’t expose.
The geographic concentration matters. Africa, the Middle East, and Asia aren’t peripheral. These are regions where China’s strategic exposure is high and where Western diplomatic activity, which Beijing needs to understand, is concentrated.
Dwell Time as a Strategy
Unit 42’s research documents a continuous operational tempo from mid-2022 through disclosure in late 2025, over three years of sustained operations without public attribution. Multiple African and Middle Eastern foreign ministries were compromised for extended periods, with Phantom Taurus maintaining access through diplomatic cycles and sensitive negotiating windows. Embassy infrastructure in multiple regions was compromised. Telecom providers across the target geography were reached.
The long dwell time isn’t incidental. It’s the objective. A classic espionage mandate: remain undetected, collect continuously, take no action that would alert the target or trigger a diplomatic incident. The group succeeded at this for years.
Defending Against a Fileless, Patient Adversary
IIS hardening is the immediate priority given the group’s access preference. Remove unnecessary modules and features, deploy web application firewall rules, maintain patch currency for IIS and the underlying Windows Server stack, and review IIS logs for unusual request patterns and web shell indicators. The IIS attack surface is underscrutinised in most environments, and the assumption that it’s a relatively boring server role works in this group’s favour.
File-based antivirus will not detect NET-STAR. Full stop. IIServerCore and AssemblyExecuter execute in memory and leave nothing on disk to scan. EDR solutions with memory scanning and behaviour-based detection, deployed on server infrastructure (not just workstations), are a prerequisite for any chance of catching this.
The fact that Phantom Taurus specifically developed AMSI and ETW bypass capabilities in V2 confirms that those controls were working against V1. Ensure AMSI is enabled and operational across the environment, and implement monitoring for common AMSI bypass techniques. If they’re bypassing it, you want to know when the bypass is attempted.
WMI lateral movement is detectable with proper logging. Sysmon or equivalent endpoint telemetry capturing WMI command execution, particularly remote WMI calls from unexpected source systems, provides the visibility needed. Without that telemetry, you’re flying blind on this actor’s lateral movement phase.
For foreign affairs ministries and diplomatic mission operators: share Phantom Taurus indicators through sector-specific channels. The group’s shared infrastructure with APT27, APT41, and Mustang Panda means indicators attributed to those actors may overlap. Treating those as distinct and unrelated threat sets is a mistake.
Personnel involved in sensitive diplomatic negotiations, particularly involving or about China’s interests in Africa, the Middle East, and Asia, should be treated as individuals warranting elevated security monitoring. Not because they’re suspected, but because they’re the collection priority.