Home › Threat Actors › Phantom Taurus
← All Threat Actors
Nation-State critical China (PRC)

Phantom Taurus

Chinese state-aligned APT · Espionage / diplomatic intelligence collection

Reports 1
Active Since 2023
Last Reported 22 May 2026
Sectors Targeted communications, critical-infrastructure

Tactics, Techniques & Procedures (TTPs)

  • NET-STAR fileless malware suite — deployed via IIS ISAPI filter abuse, no files written to disk
  • In-memory execution with persistence surviving IIS restarts without on-disk artefacts
  • Targeting of foreign ministry intranet portals and embassy web infrastructure
  • Infrastructure overlaps with APT27, Winnti, and Mustang Panda
  • Exceptional operational security — minimal forensic footprint across multi-year campaigns
  • Custom loader with anti-analysis and environment fingerprinting capabilities

Known Targets

Ministries of foreign affairs (Africa, Middle East, Asia)Embassies and diplomatic missionsTelecommunications providersMilitary organisations and defence ministries

Analyst Notes

Disclosed by Palo Alto Networks Unit 42 in September 2025. Phantom Taurus is distinguished by the NET-STAR fileless malware suite, which exploits IIS ISAPI filters for in-memory persistence — a technique rarely seen outside the most sophisticated nation-state operations. Infrastructure overlaps with APT27, Winnti, and Mustang Panda suggest relationships within the Chinese contractor ecosystem, though Phantom Taurus is treated as a distinct intrusion cluster. Targeting is tightly focused on diplomatic intelligence of direct value to PRC foreign policy objectives.

Also Known As

NET-STAR cluster

MITRE ATT&CK Techniques

T1055 Process Injection T1505.004 Server Software Component: IIS Components T1027 Obfuscated Files or Information T1071.001 Application Layer Protocol: Web Protocols T1036 Masquerading

Intelligence Reports

Analysis communicationscritical-infrastructure

Phantom Taurus: China's Surgical New APT Targeting Governments and Embassies Worldwide

Unit 42 researchers have unmasked Phantom Taurus, a previously undocumented Chinese state-aligned APT deploying the bespoke NET-STAR malware suite against ministries of foreign affairs, embassies, and telecoms across Africa, the Middle East, and Asia.

22 May 2026 · 10 min read