"Phantom Taurus' main focus areas include ministries of foreign affairs, embassies, geopolitical events, and military operations," Palo Alto Networks Unit 42 researcher Lior Rochberger said. Its attacks demonstrate stealth, persistence, and an ability to quickly adapt their tactics, techniques, and procedures (TTPs)." "The group takes an interest in diplomatic communications, defense-related intelligence and the operations of critical governmental ministries," the company said. "The timing and scope of the group's operations frequently coincide with major global events and regional security affairs." Phantom Taurus' modus operandi also stands out due to the use of custom-developed tools and techniques rarely observed in the threat landscape.