ShadowGuard
ShadowGuard is a custom Linux kernel rootkit used in the “Shadow Campaigns” cyber-espionage activity attributed by Palo Alto Networks Unit 42 to the Asia-based, state-aligned cluster tracked as TGR-STA-1030 (aka UNC6619). Unit 42 describes ShadowGuard as an Extended Berkeley Packet Filter (eBPF) rootkit/backdoor that operates in kernel space to provide stealth and evasion.
Capabilities and behavior (as described in the content):
- Kernel-level eBPF rootkit for Linux systems.
- Conceals process information by intercepting system calls, including hiding processes from standard tools (e.g., ps); reported ability to hide up to 32 PIDs.
- Hides artifacts by concealing directories and files named “swsecret.”
- Includes a mechanism allowing operators to define processes that should remain visible.
- Checks for root privileges and for eBPF/tracepoint support before operating.
Operational context:
- Reported as previously undocumented and assessed by Unit 42 to be unique to TGR-STA-1030/UNC6619.
- Used to hide malicious activity at the kernel level and evade detection by security tools during long-running espionage intrusions.
Associated indicator (from the content):
- ShadowGuard SHA-256: 7808b1e01ea790548b472026ac783c73a033bb90bbe548bf3006abfbcb48c52d.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Another tool of note is a Linux kernel rootkit codenamed ShadowGuard that utilizes the Extended Berkeley Packet Filter (eBPF) technology to conceal process information... and conceal directories and files named "swsecret."
Techniques & procedures
8 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniques"...exploited known vulnerabilities in Microsoft Exchange, SAP, and Atlassian products."
Stealth
5 techniques"a Linux kernel rootkit codenamed ShadowGuard that utilizes the Extended Berkeley Packet Filter (eBPF) technology to conceal process information... intercept critical system calls... and conceal directories and files named 'swsecret.'"
"...hide malicious activity at the kernel level and evade detection by security tools."
"It can also hide from manual inspection files and directories named swsecret."
"ShadowGuard conceals malicious process information at the kernel level, hides up to 32 PIDs from standard Linux monitoring tools using syscall interception."
Exfiltration
1 technique"Sensitive data... was exfiltrated from victim email servers."
Recent activity
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Linux rootkit referenced as being used for espionage by 'TGR-STA-1030' (with 'JackMa' also mentioned in the same title).
Linux kernel-level eBPF rootkit used for stealth and persistence by hiding processes/artifacts, intercepting syscalls, and concealing specific directories/files (e.g., named “swsecret”), making user-space detection difficult.
Custom Linux kernel eBPF rootkit/backdoor that operates in kernel space to evade detection, hides up to 32 PIDs via syscall interception, and can hide files/directories named "swsecret" while allowing the operator to define processes that remain visible.
A newly developed Linux kernel-mode rootkit used for stealthy operations and long-term persistence/hidden access during an espionage campaign.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.