Overview

• Unit 42 elevated a long-tracked activity cluster to a distinct group, Phantom Taurus, reporting recent operations and almost 10 victims of geopolitical importance across three regions.
• The group deploys a custom .NET toolkit called NET-STAR on IIS servers, including the fileless IIServerCore backdoor and AssemblyExecuter V1/V2 loaders with AMSI and ETW bypasses for in-memory execution.
• Operators shifted from email theft on Microsoft Exchange to direct database collection by executing an mssq.bat script via WMI to query SQL Server data and export results to CSV, including searches tied to Afghanistan and Pakistan.
• Intrusions commonly begin by exploiting unpatched internet-facing services such as IIS and Exchange, followed by low-noise persistence using living-off-the-land techniques like WMI.
• Palo Alto Networks notes infrastructure overlap with groups such as APT27, APT41 and Mustang Panda but describes a distinct playbook, and it has published indicators of compromise while cautioning that more victims are likely to emerge.