Alloy Taurus

Alloy Taurus, a threat actor group, has been identified as a significant cybersecurity concern due to its persistent attempts at cyberespionage, primarily targeting the government sector in Southeast Asia. The activity of this group was first observed in early 2022 and continued throughout 2023, during which they employed uncommon techniques to bypass security products, enabling long-term persistence and reconnaissance within their target environments. Alloy Taurus has been linked with moderate confidence to three distinct clusters known as Stately Taurus (aka Mustang Panda), Alloy Taurus (aka Granite Typhoon), and Gelsemium, all of which targeted various governmental entities such as critical infrastructure, public healthcare institutions, financial administrators, and ministries. The activities attributed to Alloy Taurus have demonstrated a sophisticated modus operandi, including the use of updated PingPull malware to target Linux systems, abuse of the remote administration tool AnyDesk for lateral movement, and credential theft within infiltrated environments. One particular instance of activity, dubbed CL-STA-0045, has been associated with Alloy Taurus based on the combination of tools used, victimology, and overlaps with internal telemetry from Unit 42. This cluster of activity has also shown connections with Chinese state interests, further solidifying the threat posed by Alloy Taurus. In Q3 and Q4 of 2022, telemetry suggested that Alloy Taurus was active in the same environment as the CL-STA-0045 activity, indicating a sustained period of malicious activity. Communication was observed with an infrastructure overlapping with the IP address 196.216.136[.]139, previously mentioned in relation to Alloy Taurus' update of the PingPull malware. With these consistent and advanced attacks, Alloy Taurus continues to pose a significant threat, demonstrating an ability to fly under the radar while persistently targeting high-value entities.