Unit 42 Researchers Discover Multiple Espionage Operations Targeting Southeast Asian Government
Unit 42 attributes three espionage clusters targeting a Southeast Asian government to Stately Taurus, Alloy Taurus, and Gelsemium APTs.
Unit 42 investigated espionage attacks starting in late 2022 against multiple governmental entities in a Southeast Asian country, including critical infrastructure, public healthcare, financial administrators, and ministries. Analysis revealed three distinct clusters: CL-STA-0044 attributed to Stately Taurus (Mustang Panda), CL-STA-0045 to Alloy Taurus (GALLIUM), and CL-STA-0046 to Gelsemium. The first cluster used a ToneShell backdoor variant, ShadowPad, China Chopper web shells, Impacket, and credential dumping tools across roughly Q1 2021 to Q3 2023. All three operated with distinct tools, infrastructure, and long-term surveillance tradecraft consistent with APTs.
- Three distinct espionage clusters hit one Southeast Asian government
- CL-STA-0044 linked to Stately Taurus (Mustang Panda), moderate-high confidence
- CL-STA-0045 linked to Alloy Taurus (GALLIUM); CL-STA-0046 to Gelsemium
- Targets included healthcare, financial administrators, and critical infrastructure
- ToneShell variant and ShadowPad backdoors used for persistent surveillance
- ATT&CK
- T1505.003 Server Software Component: Web ShellT1071.001 Application Layer Protocol: Web Protocols
- Products
- ShadowPadImpacketChina Chopper
- Organizations
- Palo Alto NetworksUnit 42
- Countries
- Southeast Asia
From the original article
6 min read at unit42.paloaltonetworks.com
In early 2023, Unit 42 researchers began investigating a series of espionage attacks that targeted a government in Southeast Asia. These attacks focused on different governmental entities in the same country, including critical infrastructure, public healthcare institutions, public financial administrators and ministries. This appeared at first glance to be the activity of a single threat actor.
By Lior Rochberger, Tom Fakterman, Robert Falcone · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.