Chinese APT Abuses VSCode to Target Government in Asia

Unit 42 reports that the Chinese APT Stately Taurus conducted espionage against Southeast Asian government entities by abusing Visual Studio Code’s embedded reverse shell to gain footholds, establish persistence, deliver additional malware and exfiltrate data; a concurrent ShadowPad cluster was observed in the same environment, with overlapping artifacts and extensive credential-theft and lateral-movement activity. The blog provides detailed TTPs, IOCs (hashes and service names), and recommended protections for detection and mitigation.