TGR-STA-1030 “Shadow Campaigns” Global Cyberespionage Using ShadowGuard Rootkit
Threat Actor Intelligence · 2 sources · Updated 4mo ago · First seen Feb 13, 2026
A large-scale cyberespionage operation tracked as TGR-STA-1030 (also UNC6619) has been reported compromising government and critical-infrastructure organizations across 37 countries, with broader reconnaissance activity against government infrastructure in 155 countries. The operation—described as “Shadow Campaigns”—uses phishing (often impersonating government entities) and N-day vulnerability exploitation across multiple enterprise and edge products (including SAP, Microsoft Exchange, and D-Link) to gain initial access, then deploys tooling for persistence, lateral movement, and stealth.
Post-compromise activity includes deployment of Diaoyu Loader to stage frameworks and remote admin tooling such as Cobalt Strike and VShell, plus web shells and tunneling utilities. A notable capability is ShadowGuard, a Linux eBPF rootkit used for kernel-level stealth. Reporting also indicates Palo Alto Networks’ Unit 42 assessed the actor as state-aligned and operating out of Asia, citing indicators such as tooling, language preferences, activity patterns aligned to GMT+8, and infrastructure linkages; separate reporting claims Unit 42 initially connected the campaign more directly to China but softened public attribution due to concerns about potential retaliation following Chinese restrictions on certain foreign cybersecurity vendors’ software.
