---
title: Chinese 'Phantom Taurus' Hackers Deploy Advanced Net-Star Malware in Global Espionage Campaign
description: Discover how 'Phantom Taurus' uses unconventional tactics in espionage against global governments, posing threats with their Net-Star malware.
canonical_url: https://codekeeper.co/ticker/phantom-taurus-espionage-net-star-malware
---

# Chinese 'Phantom Taurus' Hackers Deploy Advanced Net-Star Malware in Global Espionage Campaign

Discover how 'Phantom Taurus' uses unconventional tactics in espionage against global governments, posing threats with their Net-Star malware.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Oct 1, 2025

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fphantom-taurus-espionage-net-star-malware%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fphantom-taurus-espionage-net-star-malware%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fphantom-taurus-espionage-net-star-malware%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fphantom-taurus-espionage-net-star-malware%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fphantom-taurus-espionage-net-star-malware%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fphantom-taurus-espionage-net-star-malware%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

A Chinese state-sponsored group called 'Phantom Taurus' has been conducting sophisticated espionage operations against government and telecommunications organizations across Africa, the Middle East, and Asia for over two years. What makes this group unique is their use of unconventional tactics that differ from typical Chinese hacking methods, helping them stay under the radar. The hackers recently deployed Net-Star, a powerful .NET malware suite that targets IIS web servers through three backdoors, including one that operates entirely in computer memory. They're particularly interested in diplomatic communications and defense intelligence, often timing their attacks around major global events. The group has successfully infiltrated email servers and databases at high-value targets like foreign ministries and embassies. **Source:** [Security Week](https://www.securityweek.com/chinese-apt-phantom-taurus-targeting-organizations-with-net-star-malware/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fphantom-taurus-espionage-net-star-malware%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fphantom-taurus-espionage-net-star-malware%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fphantom-taurus-espionage-net-star-malware%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fphantom-taurus-espionage-net-star-malware%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fphantom-taurus-espionage-net-star-malware%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fphantom-taurus-espionage-net-star-malware%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Cyberattacks Jordan Detains Alleged ShinyHunters Leader Oct 6, 2026](https://codekeeper.co/ticker/teen-hacker-rey-arrested-cooperates-with-fbi)

[FortiBleed Campaign Linked to Inc and Lynx Ransomware Gangs Aug 12, 2026](https://codekeeper.co/ticker/fortibleed-attack-ransomware-nextcloud-exploit)

[Vulnerabilities Chained Zero-Days in SonicWall's SMA 1000 Enable Unauthenticated RCE Sep 4, 2026](https://codekeeper.co/ticker/sonicwall-zero-day-vulnerabilities-patch-now)

[Critical JetBrains TeamCity Flaw Lets Attackers Run Commands Without Logging In Aug 11, 2026](https://codekeeper.co/ticker/jetbrains-teamcity-critical-vulnerability-patch)