Phantom Taurus
aka CL-STA-0043, TGR-STA-0043
A China-nexus espionage group that targets foreign ministries, embassies and telecoms in Africa, the Middle East and Asia. It has moved from stealing email to pulling data straight from databases.
- Alert level
- 1/ 5
- Reports & advisories (90 days)
- 0
- Known exploited CVEs
- 0
- Personal data leaked (disclosed)
- None confirmed
Attribution
- Assessed as a Chinese-nexus actor aligned with PRC state interests — Palo Alto Networks Unit 42
Exploited vulnerabilities and targeted products
If you run any of these products, first make sure they are updated to a fixed version.
How they attack
Inside
Back doors that live only in memory
Like a burglar who never touches the floor, so there are no footprints to find.
Inside
Faking file dates
Like back-dating a newly planted document so it looks like it has always been there.
Goal
Raiding databases directly
Like skipping individual letters and copying the archive's master ledger instead.
Sources
Attributions are quoted as assessed by governments and security vendors. VulnPulse does not make attributions itself.
Leak counts only add up figures disclosed by the affected companies or authorities, never the attackers' own claims. We do not list victim names or link to leak sites.
The alert level is calculated automatically from reports and advisories in the last 90 days, known exploited vulnerabilities, and whether the group has targeted Japan.
Updated 2026-10-23 · daily