Skip to content
Protecting Your Smart Tech World — Explore the Latest in Smart Tech

New Cyber Threat Group Phantom Taurus Targets Governments and Critical Infrastructure

Phantom Taurus, a new high-level threat, targets governments and critical infrastructure. Its malware and tactics pose a significant risk to global security.

,   and  Administrator
1 min read
In the picture we can see three boys standing near the desk on it, we can see two computer systems...
In the picture we can see three boys standing near the desk on it, we can see two computer systems towards them and one boy is talking into the microphone and they are in ID cards with red tags to it and behind them we can see a wall with an advertisement board and written on it as Russia imagine 2013.

New Cyber Threat Group Phantom Taurus Targets Governments and Critical Infrastructure

Cybersecurity experts have uncovered a new threat group, Phantom Taurus, which has been actively targeting governments, military, and critical infrastructure across Africa, Asia, and the Middle East. The group, linked to China, has been operating for two years, employing distinctive tactics and causing significant concern due to its high-level targets.

Phantom Taurus uses a combination of common and custom tools for its espionage operations. It employs China Chopper, Potato suite, and Impacket, along with its own malware family, Specter, and a new undocumented suite called NET-TAURUS. This malware targets Internet Information Services (IIS) web servers, enabling the group to maintain long-term access to critical targets.

The group's tactics have evolved over time. Initially focusing on stealing specific emails, Phantom Taurus has recently shifted to targeting databases using a script named mssq.bat. Its operations are highly covert, employing distinctive tactics, techniques, and procedures (TTPs).

Palo Alto Networks, which discovered the group's activities, has shared its findings with the Cyber Threat Alliance (CTA) and upgraded its protections against Phantom Taurus. It has also published indicators of compromise to aid other organizations in detecting and responding to the threat.

Phantom Taurus is considered one of the top global threats due to its targeting of high-level geopolitical intelligence and critical telecommunications infrastructure. Its use of sophisticated malware and tactics makes it a significant concern for governments and organizations worldwide. Cybersecurity experts urge vigilance and cooperation in countering this threat.

Read also:

Related

Latest