Unit 42 Exposes Shadow Campaigns, a State-Aligned Espionage Operation That Breached 70 Government Organizations Across 37 Countries
Palo Alto Networks researchers reveal TGR-STA-1030, an Asia-based threat group that compromised law enforcement agencies, finance ministries, and telecoms across 37 countries while scanning government infrastructure in 155 nations.
Overview
Palo Alto Networks’ Unit 42 threat intelligence team has disclosed one of the most far-reaching cyberespionage campaigns uncovered in recent years. A previously unknown group tracked as TGR-STA-1030, also designated UNC6619, compromised more than 70 government and critical infrastructure organizations across 37 countries over the course of a single year, according to the Unit 42 report published on February 7, 2026. Unit 42 researcher Pete Renals called it “probably the most widespread and significant compromise of global government infrastructure by a state-sponsored group since SolarWinds,” as reported by The Record.
Unit 42 assesses with high confidence that TGR-STA-1030 is state-aligned and operates out of Asia, based on operating hours aligned with the GMT+8 timezone, regional tooling preferences, and targeting patterns that correlate with geopolitical events, according to CSO Online.
What We Know
Scale and Scope
The campaign’s confirmed victims span five continents. According to BleepingComputer, the group compromised five national law enforcement and border control entities, three finance ministries, and numerous other government departments handling economic, trade, natural resources, and diplomatic functions. One nation’s parliament and a senior elected official of another country were also breached, according to Unit 42.
Confirmed compromises include organizations in Brazil, Mexico, Germany, Czechia, Greece, Italy, Poland, Indonesia, Malaysia, Mongolia, Taiwan, Thailand, and more than two dozen other countries across the Americas, Europe, Asia-Pacific, and Africa, as detailed by BleepingComputer. Between November and December 2025, the group conducted active reconnaissance against government infrastructure associated with 155 countries, according to Unit 42.
Targeting Pattern
The group’s victim selection reveals a strategic intelligence-gathering focus. According to Unit 42, the targeting prioritizes countries with strategic economic partnerships, particularly regarding rare earth mineral access, trade agreements, and diplomatic relations. Brazil’s Ministry of Mines and Energy was among the confirmed victims, as reported by BleepingComputer.
The group also timed operations to geopolitical events. According to CSO Online, the group began scanning Czech government infrastructure immediately after the Czech president met with the Dalai Lama in August 2025, and targeted over 200 IP addresses in Honduras 30 days before national elections. In Venezuela, activity intensified after the United States launched Operation Absolute Resolve in January 2026, as reported by BleepingComputer.
Tools and Techniques
The group relies on spear-phishing campaigns with highly tailored lures referencing internal ministry reorganizations, delivered via malicious ZIP archives hosted on Mega.nz, according to BleepingComputer. A custom malware loader dubbed Diaoyu checks for specific security products including Kaspersky, Avira, Bitdefender, Sentinel One, and Norton before deploying Cobalt Strike payloads from GitHub repositories, as detailed in the Unit 42 report.
The group’s technical arsenal includes five different command-and-control frameworks — Cobalt Strike, VShell, Havoc, SparkRat, and Sliver — along with three web shells and multiple tunneling tools, according to CSO Online. Rather than deploying zero-day exploits, the group leverages known vulnerabilities in widely used software including SAP, Microsoft Exchange, and D-Link systems, as reported by Unit 42.
The ShadowGuard Rootkit
Perhaps the most significant technical discovery is ShadowGuard, a previously undocumented Linux kernel rootkit based on Extended Berkeley Packet Filter (eBPF) technology that appears unique to this group. According to BleepingComputer, the rootkit operates entirely within kernel space, allowing it to intercept system calls and hide up to 32 processes simultaneously from standard monitoring tools. Researchers noted that eBPF backdoors are “notoriously difficult to detect” because they bypass traditional security monitoring by operating within the highly trusted kernel space, as reported by BleepingComputer.
What We Don’t Know
Unit 42 has not attributed TGR-STA-1030 to a specific nation, noting only that the group operates from Asia. The full extent of data exfiltration from compromised organizations remains unclear, as does whether additional organizations beyond the 70 confirmed victims were breached during the November-December 2025 reconnaissance surge. The researchers have not disclosed how long the group maintained access to individual victims, though The Record reported that some compromises lasted months.
The identity behind one operator’s handle, “JackMa,” referenced in the Unit 42 report, has not been elaborated upon publicly.
Analysis
The Shadow Campaigns represent a significant escalation in state-sponsored cyberespionage operations, both in geographic scope and in the sophistication of the tooling involved. The combination of a novel eBPF rootkit, five different C2 frameworks, and operationally timed targeting suggests a well-resourced intelligence operation rather than an opportunistic criminal enterprise.
The group’s preference for exploiting known vulnerabilities rather than zero-days underscores a persistent gap in global government patch management. That 70 organizations across 37 countries fell to N-day exploits in widely deployed software such as SAP and Microsoft Exchange highlights the challenge facing government IT departments worldwide, particularly in developing nations where cybersecurity resources are thinnest.
The scale of the reconnaissance phase — 155 countries in just two months — suggests that the confirmed 37-country compromise count may represent only a fraction of the group’s total operational reach.