CyberWire Daily: China’s Stealthiest Spy Operation Yet – Phantom Taurus

Research Saturday | Date: October 4, 2025
Host: Dave Buettner, N2K Networks
Guest: Assaf Dahan, Director of Threat Research, Palo Alto Networks Unit 42

Episode Overview

This Research Saturday episode unpacks the discovery and investigation of “Phantom Taurus,” a newly identified, highly advanced Chinese state-sponsored espionage group. Dave Buettner interviews Assaf Dahan of Unit 42 at Palo Alto Networks, probing the origins, unique tactics, persistence, and strategic impact of Phantom Taurus, one of the most sophisticated and tenacious cyber threats currently targeting governments across Africa, the Middle East, and Asia.

Key Discussion Points & Insights

Who is Phantom Taurus? (01:25–03:09)

• Phantom Taurus is a newly discovered state-sponsored Chinese APT (advanced persistent threat) group.
• Targets: Primarily governments, embassies, foreign ministries, and defense sectors.
• Scope & Scale:
  • Activity detected across Africa, the Middle East, and Asia.
  • Noteworthy for intelligence collection on a scale and focus not previously attributed to known groups.
• Significance: The discovery marks a rare uncovering of a "top tier" new APT, as most observed cyberactivity is generally attributable to known actors.

"It’s not every day that we get to uncover a brand new, what we call a top tier APT."
—Assaf Dahan (02:11)

Phantom Taurus & the Chinese Cyber Landscape (03:09–05:14)

• Role in State Objectives: Fits into China’s broad ecosystem of cyber espionage groups.
  • Some groups target intellectual property/technology; Phantom Taurus is squarely focused on classic intelligence gathering.
  • Highly responsive to geopolitical events, often targeting entities before state-level meetings or summits.
• Distinctive Intent: Less interested in economic espionage, more in real-world power dynamics.

"They really fit into the more traditional side of the spying games... The correlation with geopolitical events was pretty striking."
—Assaf Dahan (03:18)

Tactics, Techniques, and Procedures (TTPs) (05:14–08:35)

• Extreme Persistence:
  • Unlike many APTs, they bounce back within days or even hours of being discovered, not months or years.
  • "They put the P in APT, as we like to say." (05:27)
• Custom Tooling:
  • Use exclusively homegrown, state-of-the-art tools (e.g., Net Star suite, Spectre malware suite).
  • Designed for extraordinary stealth—tools not observed elsewhere.
• Attack Approach:
  • Rarely use spear phishing or social engineering.
  • Directly compromise vulnerable infrastructure, such as core servers (database, email/Exchange, etc.).
  • Bypass individuals and head straight for critical info repositories.

"[Phantom Taurus is] not the sort of threat actor that goes after individuals... They go straight to the jugular."
—Assaf Dahan (07:10)

Evolving Data Collection Strategies (08:35–10:08)

• Phantom Taurus shifted focus from targeting email servers to backend databases.
• Motivation: Backend databases aggregate far more information—“more bang for the buck”.
• They still retain capacity for both methods, but the trend is clear.

"Most of their current activity revolves around trying to get into databases... where they can get the most bang for their buck."
—Assaf Dahan (08:48)

Attribution Journey: Unmasking a New Actor (12:09–16:25)

• Duration: 2.5 years of investigation were required to confidently define Phantom Taurus as a distinct entity.
• Methodology:
  • A process of collecting data points, analyzing patterns, and comparing activity against 20+ tracked Chinese APTs.
  • Reluctance to "name a new group" unless rigorously validated.
• Key People: Researcher Leo Rockberger led the investigation, described as “the main speedboat” driving persistence.

"As threat intelligence or threat researchers, we are probably the last people who want to throw a new name into the already growing pile... but we really took a lot of time and effort to make sure that this is a new threat actor."
—Assaf Dahan (15:50)

The Culture of Threat Research (17:14–19:16)

• Research Approach: Not purely academic; research feeds product defenses with actionable intelligence (IOCs, rules, ML training).
• Long-term Tracking Value:
  • Enables deeper understanding of adversary motives, tactics, and potential next moves.
  • Facilitates proactive defense and anticipatory detection.

"When you monitor threat actors so closely, you get to learn their [modus operandi] and... can anticipate their next moves."
—Assaf Dahan (18:13)

Takeaways for Defenders (19:16–21:38)

• Root Causes of Breaches:
  • 90% stem from basic issues: unpatched, outdated systems—not “fancy zero-days.”
• Defensive Advice:
  • Good IT hygiene, regular patch management, and securing Internet-facing systems are still the most impactful.
  • Even highly skilled APTs often exploit simple, preventable weaknesses first.

"The root cause of 90% of their success... has to do with patch management or lack thereof, outdated versions, unpatched servers."
—Assaf Dahan (19:38)

Notable Quotes & Memorable Moments

• Persistence of Phantom Taurus:
  “They put the P in APT, as we like to say, when it comes to persistence.” —Assaf Dahan (05:29)

• Detection Philosophy:
  "It's been a journey... After two and a half years... we're pretty confident in coming up with a new threat actor." —Assaf Dahan (12:09–15:50)

• Practical Security Reminder:
  ”Sometimes it seems like almost too easy because the servers or Internet-facing systems are not guarded enough.” —Assaf Dahan (20:20)

Timestamps of Key Segments

| Timestamp | Segment Description | |-----------|-----------------------------------------------------------------------------------| | 01:25 | Introduction to Phantom Taurus: origins & primary targets | | 03:18 | The group's alignment in the landscape of Chinese cyber operations | | 05:27 | Discussion of unique tactics, extreme persistence, and homegrown malware | | 08:48 | Evolution in data collection focus: shift from emails to backend databases | | 12:09 | Attribution journey—how Phantom Taurus was confirmed as a new actor | | 16:35 | Spotlight on lead researcher Leo Rockberger and research tenacity | | 17:40 | Importance of deep, product-integrated research in cybersecurity | | 19:26 | Takeaways for defenders: importance of basic security hygiene and patching |

Conclusion

Dave Buettner and Assaf Dahan’s conversation illuminates the intricate work behind identifying Phantom Taurus and reaffirms the critical importance of fundamental security measures—even against the world’s most sophisticated threat actors. The episode underscores the value of long-term, rigorous threat research and collaboration, offering practical lessons for defenders worldwide.