Loading malware…
ShadowGuard is a custom Linux kernel rootkit used in the “Shadow Campaigns” cyber-espionage activity attributed by Palo Alto Networks Unit 42 to the Asia-based, state-aligned cluster tracked as TGR-STA-1030 (aka UNC6619). Unit 42 describes ShadowGuard as an Extended Berkeley Packet Filter (eBPF) rootkit/backdoor that operates in kernel space to provide stealth and evasion.
Capabilities and behavior (as described in the content):
Operational context:
Associated indicator (from the content):
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Another tool of note is a Linux kernel rootkit codenamed ShadowGuard that utilizes the Extended Berkeley Packet Filter (eBPF) technology to conceal process information... and conceal directories and files named "swsecret."
8 distinct techniques documented for this family, organized by ATT&CK tactic.
"a Linux kernel rootkit codenamed ShadowGuard that utilizes the Extended Berkeley Packet Filter (eBPF) technology to conceal process information... intercept critical system calls... and conceal directories and files named 'swsecret.'"
"...hide malicious activity at the kernel level and evade detection by security tools."
"It can also hide from manual inspection files and directories named swsecret."
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Linux rootkit referenced as being used for espionage by 'TGR-STA-1030' (with 'JackMa' also mentioned in the same title).
Linux kernel-level eBPF rootkit used for stealth and persistence by hiding processes/artifacts, intercepting syscalls, and concealing specific directories/files (e.g., named “swsecret”), making user-space detection difficult.
Custom Linux kernel eBPF rootkit/backdoor that operates in kernel space to evade detection, hides up to 32 PIDs via syscall interception, and can hide files/directories named "swsecret" while allowing the operator to define processes that remain visible.
A newly developed Linux kernel-mode rootkit used for stealthy operations and long-term persistence/hidden access during an espionage campaign.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.