A newly-discovered threat group linked to China is targeting governments, the military, and other critical bodies across Africa, the Middle East, and Asia for espionage.
Palo Alto Networks said the group, which it has dubbed Phantom Taurus, belongs in the top tier of global threats.
"This is largely due to their targeting of both high-level geopolitical intelligence and entities (embassies, foreign ministries, diplomats) and critical telecommunications infrastructure, making them very much a dual threat," the researchers warned.
Phantom Taurus has been operating for two years, using a distinctive set of tactics, techniques, and procedures (TTPs) that allow it to conduct highly covert operations.
Alongside more common tools, such as China Chopper, the Potato suite, and Impacket, the group uses customized tools, including the Specter malware family and Ntospy. It's also been able to maintain long-term access to critical targets through a custom-built malware suite called NET-STAR.
Since 2023, Phantom Taurus has focused on stealing sensitive and specific emails of interest from email servers – but has more recently shifted to the direct targeting of databases using a script named mssq.bat.
This connects to an SQL Server database with a given server name, a user ID named sa (system administrator), and a password that the attackers previously obtained. It then reads the SQL query provided in the command-line arguments by the group's operators, allowing dynamic searching for tables and specific keywords.
Finally, it executes the provided query and returns the results that match the user's search, exports the results to a CSV file, and closes the database connection.
Perhaps most significantly, the group is using a new and undocumented malware suite, NET-STAR, designed to target Internet Information Services (IIS) web servers.
"The NET-STAR malware suite demonstrates Phantom Taurus' advanced evasion techniques and a deep understanding of .NET architecture, representing a significant threat to internet-facing servers," the researchers said.
The suite consists of three distinct web-based backdoors, each carrying out a specific role in the attack chain, while maintaining persistence within the target's IIS environment.
IIServerCore is a fileless modular backdoor that supports in-memory execution of command-line arguments, arbitrary commands and payloads; AssemblyExecuter V1 loads and executes additional .NET payloads in memory; and AssemblyExecuter V2 is an enhanced version of AssemblyExecuter V1 that's also equipped with Antimalware Scan Interface (AMSI) and Event Tracing for Windows (ETW) bypass capabilities.
Palo Alto Networks has published indicators of compromise here, and has upgraded its Advanced WildFire machine-learning models and Cortex XDR to give better protection. It said it has also shared its findings with fellow Cyber Threat Alliance (CTA) members, and is recommending that they do the same.
Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.
MORE FROM ITPRO
-
Small businesses can't get cyber strategies up and running – here's whyNews SMBs are turning to outside help to shore up security as internal strategies fall flat
-
Former NCSC head says the Jaguar Land Rover attack was the 'single most financially damaging cyber event ever to hit the UK' as impact laid bareNews Researchers said they place the UK financial impact of the attack on Jaguar Land Rover at around £1.9 billion.
-
Using AI to code? Watch your security debtnews Black Duck research shows faster development may be causing risks for companies
-
Organizations warned of "significant lag" in deepfake protection investmentnews Defenses are failing to keep up with the rapidly growing attack vector, with most organizations being overconfident
-
Teens arrested over nursery chain Kido hacknews The ransom attack caused widespread shock when the hackers published children's personal data
-
Middlesbrough Council boosts cybersecurity spending, strategy in response to repeated cyberattacksNews Councils across the UK have publicly struggled with maintaining services in the face of major cyber disruption
-
Japan running super dry of its favourite beer as Asahi cyberattack continuesNews Production of Asahi beer, one of the country's favourite beverages, has been halted, and reserves are running low
-
Foreign states ramp up cyberattacks on EU with AI-driven phishing and DDoS campaignsNews ENISA warns of hacktivism, especially through DDoS attacks
