Taurus Loader - Threat Group Cards: A Threat Actor
Encyclopedia
Archived: 2026-04-05 20:20:43 UTC
Home > List all groups > List all tools > List all groups using tool Taurus Loader
 Tool: Taurus Loader
Names
Taurus Loader
Taurus Builder
Taurus Builder Kit
Category Malware
Type Botnet, Downloader
Description
(Proofpoint) We use this name to describe a tool used to create malicious documents. We
believe Taurus builder was purchased on underground crime forums. Notably, documents
created with this builder use the CMSTP bypass.
Information
Last change to this tool card: 10 July 2020
Download this tool card in JSON format
All groups using tool Taurus Loader
Changed Name Country Observed
APT groups
 Cobalt Group 2016-Oct 2019
 Venom Spider, Golden Chickens 2017-Jan 2025
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=447eedbe-c9b3-4021-9062-dae0fbf10473
Page 1 of 2

2 groups listed (2 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=447eedbe-c9b3-4021-9062-dae0fbf10473
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=447eedbe-c9b3-4021-9062-dae0fbf10473
Page 2 of 2