# China-Aligned Espionage Clusters (Stately Taurus, CL-STA-1048, CL-STA-1049) Deploy USBFect, Masol RAT, FluffyGh0st and Custom Loaders Against Southeast Asian Government

> Unit 42 identified three distinct but temporally overlapping China-aligned cyberespionage clusters targeting a Southeast Asian government organization between June-August 2025. The campaigns employed USB-based propagation via USBFect, multiple RATs (PUBLOAD, Masol RAT, FluffyGh0st, Gorem RAT), custom loaders (EggStreme, Hypnosis, ClaimLoader), and infostealers (TrackBak), linked to Stately Taurus, Earth Estries, and Unfading Sea Haze.

- **Published:** 2026-03-26T12:00:00Z
- **Last reviewed:** 2026-03-26T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0289
- **ID:** TL-2026-0289
- **Severity:** HIGH
- **Category:** APT
- **Status:** MONITORING
- **Actor:** Mustang Panda (China)
- **Detections:** 9 · **IOCs:** 65 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Between June and August 2025, Unit 42 (Palo Alto Networks) observed three distinct but temporally overlapping cyberespionage campaigns targeting the same Southeast Asian government organization. Designated Stately Taurus, CL-STA-1048, and CL-STA-1049, these clusters employed a diverse arsenal of malware families including USBFect (HIUPAN), PUBLOAD, ClaimLoader, CoolClient, EggStreme Loader, EggStremeFuel, Masol RAT, FluffyGh0st, Gorem RAT, Hypnosis Loader, TrackBak, and RawCookie.

**Stately Taurus (June-August 2025):** This cluster leveraged USBFect, a USB-propagating worm that monitors for removable drive insertion and copies itself to attached media. USBFect deployed ClaimLoader (EVENT.dll), which uses XOR decryption and the CryptEnumOIDInfo API to execute PUBLOAD shellcode in memory. PUBLOAD communicates over TCP with fake TLS headers (17 03 03) and XOR-encrypted payloads containing host reconnaissance data. CoolClient, an HP-Socket-based C2 framework supporting file operations, packet tunneling, keylogging, and port mapping, was also deployed on select endpoints with heavy anti-disassembly techniques.

**CL-STA-1048 (August 9, 2025):** This cluster executed a rapid multi-tool deployment within a 40-minute window. EggStremeFuel, a lightweight TCP-based C2 backdoor written in C, was deployed first via Microsoft Edge process injection. It stores RC4-encrypted C2 configurations in Cookies.dat and supports file operations, reverse shell, and configuration updates. Within 20 minutes, Masol RAT was deployed as a Windows service DLL using AES-encrypted HTTP POST C2 communications. Concurrently, EggStreme Loader leveraged DarkLoadLibrary and libpeconv for in-memory loading of Gorem RAT, which uses gRPC for C2 and implements 59 backdoor commands including a user-mode keylogger. TrackBak infostealer followed 40 minutes later, collecting keystrokes, clipboard data, network information, and files from all drives.

**CL-STA-1049 (August 2025):** This cluster exploited Bitdefender's seccenter.exe for DLL side-loading. The novel Hypnosis Loader masquerades as version.dll, proxying all exported functions to the legitimate system DLL while patching the host process entry point to an infinite Sleep function. It then RC4-decrypts the payload filename and loads FluffyGh0st (bdusersy.dll), a custom Gh0st RAT variant that downloads RC4-encrypted and LZNT1-compressed plugins from compromised C2 infrastructure including legitimate Thai company domains.

The convergence of three independent clusters on the same target, with shared Chinese-origin tooling and overlapping TTPs, indicates a coordinated intelligence collection operation. Attribution links to known groups including Earth Estries (Trend Micro), Crimson Palace clusters (Sophos), and Unfading Sea Haze (Bitdefender) suggest a broader state-directed campaign.

## MITRE ATT&CK

- T1091 Replication Through Removable Media
- T1106 Native API
- T1059 Command and Scripting Interpreter
- T1129 Shared Modules
- T1547 Boot or Logon Autostart Execution
- T1543 Create or Modify System Process
- T1574 Hijack Execution Flow
- T1055 Process Injection
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1620 Reflective Code Loading
- T1056 Input Capture
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1083 File and Directory Discovery
- T1570 Lateral Tool Transfer
- T1005 Data from Local System
- T1115 Clipboard Data
- T1095 Non-Application Layer Protocol
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1090 Proxy
- T1102 Web Service
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1584 Compromise Infrastructure
- T1583 Acquire Infrastructure

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0289