Specter
Specter is a customized malware family used by the China-aligned espionage actor Phantom Taurus. Unit 42 reported Phantom Taurus using the Specter malware family alongside Ntospy and the NET-STAR malware suite during long-term intelligence collection operations targeting government and telecommunications organizations across Africa, the Middle East, and Asia. The actor’s targeting has included ministries of foreign affairs, embassies, diplomatic communications, defense-related intelligence, and activity associated with geopolitical events and military operations, aligning with PRC state interests. The content references Specter as a malware family and specifically mentions variants or related names including TunnelSpecter and SweetSpecter. No additional high-confidence technical details, infection vector, or standalone indicators of compromise specific to Specter are provided in the supplied content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
These include the Specter malware family, Ntospy and NET-STAR, a newly identified malware suite.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Customized malware family used by the Phantom Taurus espionage actor as part of its implant/tooling set.
A named malware family used by Phantom Taurus; specific capabilities are not described in the provided content.
Custom malware family used by Phantom Taurus; specific functionality not detailed in the provided content beyond being part of the actor’s bespoke toolset (with named components TunnelSpecter and SweetSpecter listed in TTPs).
Custom malware family used by Phantom Taurus; the content does not provide technical details beyond naming variants (TunnelSpecter, SweetSpecter) as part of the actor toolset.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.