Stately Taurus

Stately Taurus is a sophisticated malware associated with a Chinese Advanced Persistent Threat (APT) group that conducts cyberespionage campaigns. This group has been observed targeting government entities, as well as religious and non-governmental organizations across Europe and Asia. The malware infiltrates systems to exfiltrate sensitive information, often without the victim's knowledge. It is typically delivered through spear-phishing emails, suspicious downloads, or malicious websites. In addition to its primary functions, Stately Taurus has shown adaptability in its tactics, techniques, and procedures (TTPs), as evidenced in its attacks on Southeast Asian governments. In our investigation, we have discovered a connection between Stately Taurus and another malicious software called ShadowPad. Both malwares were found operating in the same environment, often simultaneously and sometimes on the same endpoints. The Listener.bat file used by Stately Taurus was found to share origins with ShadowPad, indicating a potential link between the two. Additionally, both malwares used the same unique password, further suggesting an operational overlap. We have moderate to high confidence that the threat actor behind the activity cluster CL-STA-0044 is also associated with Stately Taurus. The implications of this connection are significant, as ShadowPad is another highly potent backdoor that allows for full control over infected systems. The fact that both malwares were found in the same network session suggests a coordinated effort to compromise and exploit targeted systems. Furthermore, the use of similar exfiltration techniques, as described in previous reports, demonstrates the consistent and advanced nature of these threats. As such, it is critical for organizations to remain vigilant and maintain robust cybersecurity measures to defend against these sophisticated threats.