CL-STA-0043

Also known as: CL-STA-0043, Phantom Taurus, TGR-STA-0043

CL-STA-0043 is a highly skilled and sophisticated threat actor, believed to be a nation-state, targeting governmental entities in the Middle East and Africa. They exploit vulnerabilities in on-premises Internet Information Services and Microsoft Exchange servers to infiltrate target networks. They engage in reconnaissance, locate vital assets, and have been observed using native Windows tools for privilege escalation.

🌍 Country China

Introduction

CL-STA-0043 is a highly skilled and sophisticated threat actor, believed to be a nation-state, targeting governmental entities in the Middle East and Africa. They exploit vulnerabilities in on-premises Internet Information Services and Microsoft Exchange servers to infiltrate target networks. They engage in reconnaissance, locate vital assets, and have been observed using native Windows tools for privilege escalation.

Activities and Tactics

Country of Origin: 🇨🇳 China

Notable Campaigns

Information pending cataloguing.

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • Windows Remote Desktop
  • Xploit
  • Killer RAT
  • Agent Racoon:
  • China Chopper:
  • Gh0st RAT:
  • HTran:
  • JuicyPotatoNG:
  • LadonGo:
  • Mimikatz:
  • Mimilite:
  • Ntospy:
  • PlugX:
  • SharpEfsPotato:
  • SweetSpecter:
  • TunnelSpecter:
  • Yasso:
  • nbtscan:

Attribution and Evidence

Country of Origin: China Additional attribution information pending cataloguing.

References

References pending cataloguing.