APT / THREAT GROUP

Taurus Stealer

aliases

Last seen:Mar 17, 2026

Intelligence Profile

According to Zscaler, Taurus is a stealer that surfaced in June 2020. It is being developed by the author(s) that previously created Predator the Thief. The name overlaps partly with the StealerOne / Terra* family (also aliased Taurus Loader) but appears to be a completely disjunct project.

Threat Analysis

Taurus Stealer is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://blog.minerva-labs.com/taurus-stealers-evolution

→https://blog.morphisec.com/google-ppc-ads-deliver-redline-taurus-and-mini-redline-infostealers

→https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Additional%20Analysis/UnknownTA/2020-09-07/Analysis.md

→https://go.recordedfuture.com/hubfs/reports/cta-2022-0802.pdf

→https://outpost24.com/blog/an-in-depth-analysis-of-the-new-taurus-stealer/

Quick Facts

TypeAPT / Threat Group

Aliases2

Also Known As

Taurus Stealerwin.taurus_stealer

External Intelligence

Malpedia: win.taurus_stealer

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Taurus Stealer