Palo Alto Networks spots new China espionage group showcasing advanced skills

Unit 42 has identified a previously undocumented China-linked espionage group called Phantom Taurus that has compromised nearly ten high-value targets (ministries of foreign affairs, embassies, diplomats, and telecom networks) across the Middle East, Africa, and Asia. The group uses a bespoke NET-STAR malware suite with stealthy in-memory and .NET payload techniques, maintains long-term opportunistic access—sometimes for nearly two years—and commonly gains initial access by exploiting unpatched internet-facing devices; Unit 42 published TTPs, indicators, and malware analysis to enable detection and response.