Threat actor

Stately Taurus

0 mentions in 7 days · 2 in 30 days · 2 total · first seen Aug 17, 2026 · last 29d ago

Timeline2 articles

Unit 42 Researchers Discover Multiple Espionage Operations Targeting Southeast Asian Government

Unit 42 attributes three espionage clusters targeting a Southeast Asian government to Stately Taurus, Alloy Taurus, and Gelsemium APTs.

Unit 42 investigated espionage attacks starting in late 2022 against multiple governmental entities in a Southeast Asian country, including critical infrastructure, public healthcare, financial administrators, and ministries. Analysis revealed three distinct clusters: CL-STA-0044 attributed to Stately Taurus (Mustang Panda), CL-STA-0045 to Alloy Taurus (GALLIUM), and CL-STA-0046 to Gelsemium. The first cluster used a ToneShell backdoor variant, ShadowPad, China Chopper web shells, Impacket, and credential dumping tools across roughly Q1 2021 to Q3 2023. All three operated with distinct tools, infrastructure, and long-term surveillance tradecraft consistent with APTs.

Palo Alto Unit 42Aug 17, 10:57 UTC · 29d agoThreat actor in the wild

Stately Taurus Activity in Southeast Asia Links to Bookworm Malware

Unit 42 links Stately Taurus APT activity in ASEAN region and Myanmar to the decade-old Bookworm malware family via infrastructure overlaps.

Unit 42 connected Stately Taurus (aka Mustang Panda) espionage activity targeting ASEAN-affiliated organizations and Myanmar to the Bookworm malware family, first published in 2015. Earlier attacks delivered the PubLoad stager via DLL sideloading, with a PubLoad variant communicating with C2 at 123.253.32[.]15 while mimicking Windows Update URLs. Three previously unreported loader samples from 2021-2022 used UUID-decoded shellcode loaded via heap allocation and API callbacks, ultimately decrypting and loading Bookworm DLLs. A ToneShell backdoor variant shared debug paths with Bookworm loaders, and the January 2024 CSIRT CTI post corroborated the Myanmar attacks.

Palo Alto Unit 42Aug 17, 10:54 UTC · 29d agoThreat actor in the wild

Appears with

organization Palo Alto Networks 2 organization Unit 42 2 malware ToneShell 2 threat actor Mustang Panda 2 malware Bookworm 1 malware PubLoad 1 malware ShadowPad 1 organization CSIRT CTI 1 organization Lab52 1 organization NCC Group 1 product Bookworm 1 product China Chopper 1 product Impacket 1 product PubLoad 1 product ShadowPad 1 product ToneShell 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.