Phantom Taurus Flexes NET-STAR Malware While Salt Typhoon Spices Up US Telecom Hacks

This is your Digital Frontline: Daily China Cyber Intel podcast. Reporting from the digital trenches, this is Ting—your cocky curator of China cyber chaos and all things espionage. No time for drawn-out intros: Here’s the headline—Phantom Taurus and Salt Typhoon, two marquee names from Beijing’s hacking playbook, have powered up with some shiny new tricks, and US interests are smack in the crosshairs. Today’s plot twist stars Phantom Taurus, the group now notorious for its NET-STAR malware suite. If you’re picturing a digital ninja, you’re close—Palo Alto Networks’ Unit 42 confirmed this crew targets government and telecom organizations all over Africa, the Middle East, and Asia, with the attacks coinciding suspiciously with major global diplomatic events. Their toolkit is uniquely gnarly, equipped with the fileless IIServerCore backdoor, the AssemblyExecuter strain that slips right by anti-malware scans, and custom-code Specter and Net-Star malware designed to infiltrate IIS web servers—and trust me, these payloads have a serious stealth game. NET-STAR is engineered to stay quiet while siphoning off diplomatic emails and targeting SQL databases with a script called mssq.bat, giving them root access to whatever juicy data sits behind the admin curtain. But don’t let their globe-trotting targets fool you: Chinese APTs are making plenty of moves stateside. The Salt Typhoon group, operating under the direction of China’s Ministry of State Security through front companies like i-SOON and Sichuan Juxinhe Network Technology, has ransacked at least a dozen US telecoms since 2019. In the past day, new indicators show their modular malware implants are still active across edge devices—routers, firewalls, VPN gateways—harvesting metadata and network diagrams from telecoms and even state National Guard networks. The US Department of Justice recently fingered network operator Yin Kecheng and ex-i-SOON consultant Zhou Shuai, highlighting the industrial system Beijing uses for cyber ops. The whole operation is a masterclass in deniability and persistence, using bespoke malware, backdoored firmware, and fake US personas registered with real SSL certificates to worm into American networks and stick around. On the defensive side, advisory teams are basically waving neon "Patch Now!" signs. Palo Alto, CrowdStrike, and the Cybersecurity and Infrastructure Security Agency have all emphasized the need to monitor for new domains and SSL certs using familiar PRC naming conventions, audit passive DNS traffic, and watch for firmware anomalies—especially if you’re in telecoms or government contracting. Telecom operators are also being told to fortify configuration management and run enhanced anomaly detection on VoIP and lawful intercept systems. CrowdStrike’s 2025 Global Threat Report summed it up: Chinese state-backed cyber activity has hit an inflection point, rising 150% across all sectors. No sector is immune—defense, infrastructure, even downstream vendors. For This content was created in partnership and with the help of Artificial Intelligence AI.