Skip to content

Converging Interests: Analysis of Threat Clusters Targeting a Southeast Asian Government

0.6071
Chimera Difficulty Score
a synthesis of Flesch-Kincaid, Coleman-Liau, SMOG, and Dale-Chall readability metrics
Executive Summary Unit 42 researchers uncovered a series of cyberespionage campaigns targeting a government organization in Southeast Asia. Our initial investigation began with tracking Stately Taurus activity between June 1–Aug. 15, 2025. This activity involves USB-propagated malware called USBFect (aka HIUPAN), which deploys a PUBLOAD backdoor. Our investigation led to the discovery of two addit...
Steelman: The reported incident involved a sophisticated cyber attack campaign by Stately Taurus, a threat actor known for using the Bookworm malware. This group targeted institutions in Southeast Asia through various tactics, including phishing emails and exploiting vulnerabilities in widely used software like Microsoft Office and Adobe Acrobat. The attack has been ongoing since at least 2017, with recent updates to their malware and tactics. Patterns detected: ARC-0043 Motte-and-Bailey (Statel...