[threat-actors] Update CL-STA-0043 (Phantom Taurus)

[Aryu-RU]

What

Enriches the existing CL-STA-0043 entry in clusters/threat-actor.json to consolidate the Phantom Taurus name that Palo Alto Networks Unit 42 assigned to this activity cluster in September 2025. This is a single-entry change (uuid 5d0aee14-f18a-44da-a44d-28d950f06b9c, value unchanged):

• add synonym Phantom Taurus (the entry previously listed only TGR-STA-0043);
• add the Unit 42 Phantom Taurus reference to meta.refs;
• add country: CN (PRC state-nexus attribution per Unit 42);
• refresh the description to cover the current naming lineage, the expanded targeting (telecommunications and Asia), and the NET-STAR IIS backdoor suite;
• add a uses relationship to the existing NET-STAR entry (c8ad61b6-55ff-4585-8782-5aabb3d5dcc3, malpedia cluster);
• bump the cluster version from 344 to 345.

Cross-vendor identity check

Unit 42 explicitly documents the naming lineage: the activity was originally tracked as CL-STA-0043 (June 2023), then promoted to the temporary group TGR-STA-0043, nicknamed Operation Diplomatic Specter (May 2024), and finally classified as the distinct named actor Phantom Taurus (30 September 2025). All three designations refer to the same cluster, so this is an enrichment of the existing entry rather than a new entry. Phantom Taurus had no prior occurrence anywhere under clusters/, and no other entry represents this actor under a different name.

Reference added

• https://unit42.paloaltonetworks.com/phantom-taurus/

Validation

jq_all_the_things.sh was applied; jsonschema -i clusters/threat-actor.json schema_clusters.json passes; tools.chk_empty_strings is clean; the uses dest-uuid resolves to the NET-STAR entry; the cluster version is bumped and the entry position is preserved.

[adulau]

Thank you!