The Shadow Campaigns: Uncovering Global Espionage
Summary: Unit 42 tracks a state-aligned group it calls TGR-STA-1030, operating out of Asia, that has compromised government and critical infrastructure organizations in 37 countries over the past year and conducted active reconnaissance against government infrastructure tied to 155 countries between November and December 2025. The group targets government ministries and departments through phishing lures about ministry reorganizations, N-day exploit attempts such as CVE-2019-11580 against Atlassian Crowd, and tooling that includes Cobalt Strike, VShell, Behinder, Neo-reGeorg, Godzilla web shells, and a Linux eBPF rootkit Unit 42 names ShadowGuard.
What you should know: One in five countries has suffered a critical breach from this group in a single year, and its reconnaissance touched 155 nations in two months - a scale that means your government or critical infrastructure peers are already in the target set, whether or not your own organization has been notified.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026