Reddit NetSec

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

CVE Database V5

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Phantom Taurus, a newly identified Chinese state-sponsored threat actor, has been conducting espionage operations targeting government and telecommunications organizations across Africa, the Middle East, and Asia. The group's primary focus includes ministries of foreign affairs, embassies, and military operations, with the objective of gathering sensitive information. Phantom Taurus employs distinctive tactics, techniques, and procedures, including a new malware suite called NET-STAR. This suite consists of three web-based backdoors designed to target Internet Information Services (IIS) web servers. The group has recently shifted from targeting emails to directly accessing databases, demonstrating their ability to adapt and evolve their methods. Phantom Taurus' activities align with Chinese strategic interests, and their infrastructure overlaps with other known Chinese APT groups.

Phantom Taurus is a newly identified Chinese state-sponsored advanced persistent threat (APT) group engaged in espionage campaigns primarily targeting government and telecommunications sectors across Africa, the Middle East, and Asia. Their main targets include ministries of foreign affairs, embassies, and military organizations, reflecting a strategic focus on gathering sensitive diplomatic and military intelligence. Phantom Taurus employs a sophisticated malware suite named NET-STAR, which consists of three distinct web-based backdoors specifically designed to compromise Microsoft Internet Information Services (IIS) web servers. This malware suite enables stealthy remote access and control over compromised servers, facilitating data exfiltration and lateral movement within victim networks. Notably, Phantom Taurus has evolved its tactics by shifting from traditional email-based phishing attacks to directly targeting backend databases, indicating enhanced capabilities for deep network infiltration and data theft. The group’s infrastructure shows overlaps with other known Chinese APT groups, suggesting shared resources or collaboration. Their tactics include a wide range of techniques such as credential dumping (T1003), remote service exploitation (T1021.001), code injection (T1055), persistence mechanisms (T1547.006), and use of known malware families like PlugX and Gh0st RAT. Indicators of compromise include multiple file hashes associated with their malware components. While no known exploits are currently reported in the wild for this campaign, the threat actor’s demonstrated adaptability and targeting of critical infrastructure make them a persistent risk. The campaign’s medium severity rating reflects the targeted nature of attacks and the potential for significant espionage impact rather than widespread destructive effects.

Detailed information about Phantom Taurus: A New Chinese Nexus APT and the Discovery of the NET-STAR Malware Suite. Get real-time updates, technical details, an

Phantom Taurus: A New Chinese Nexus APT and the Discovery of the NET-STAR Malware Suite - Live Threat Intelligence - Threat Radar | OffSeq.com

Phantom Taurus: A New Chinese Nexus APT and the Discovery of the NET-STAR Malware Suite

A new ransomware family called Charon has been identified, targeting the Middle East's public sector and aviation industry. The attack employs sophisticated APT-style techniques, including DLL sideloading, process injection, and anti-EDR capabilities. Charon uses a multistage payload extraction technique and a hybrid cryptographic scheme combining Curve25519 with ChaCha20 cipher. The ransomware exhibits network propagation capabilities and includes a dormant anti-EDR component. The campaign demonstrates a concerning trend of ransomware operators adopting APT-level techniques, posing an elevated risk to organizations. Defending against Charon requires a multilayered approach, including hardening against DLL sideloading, limiting lateral movement, strengthening backup capabilities, and reinforcing user awareness.

Charon is a newly identified ransomware family that leverages advanced persistent threat (APT)-style techniques attributed to the Earth Baxia adversary group. It primarily targets enterprises in the Middle East's public sector and aviation industry but demonstrates capabilities that could pose risks globally. The ransomware employs sophisticated evasion tactics such as DLL sideloading, which allows it to load malicious DLLs under the guise of legitimate processes, and process injection to stealthily execute code within trusted processes. It also includes anti-Endpoint Detection and Response (EDR) mechanisms, including a dormant anti-EDR component that can activate to evade detection tools. Charon uses a multistage payload extraction technique, complicating detection and analysis, and employs a hybrid cryptographic scheme combining Curve25519 for key exchange and ChaCha20 for encryption, ensuring strong cryptographic protection of victim data. The ransomware exhibits network propagation capabilities, enabling it to spread laterally within compromised networks, increasing its impact. The campaign reflects a concerning evolution where ransomware operators adopt sophisticated APT-level tactics, increasing the complexity and potential damage of attacks. Defending against Charon requires a multilayered security approach focusing on hardening systems against DLL sideloading, restricting lateral movement through network segmentation and strict access controls, enhancing backup and recovery strategies to mitigate ransomware impact, and reinforcing user awareness to prevent initial infection vectors such as phishing. Indicators of compromise include specific file hashes that can be used for detection and response. Although currently observed primarily in the Middle East, the advanced techniques and targeting of critical sectors like aviation suggest a broader potential threat landscape.

Detailed information about New Ransomware Charon Uses Earth Baxia APT Techniques to Target Enterprises. Get real-time updates, technical details, and mitigation

Title	Severity	Type	Source	Date

Threats Tagged 'middle east'

Filter Threats

Threats Tagged 'middle east'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility