TGR-STA-1030

Summary

Asia-based, state-aligned cyberespionage group designated by Unit 42 in Feb 2026 (Unit 42: high confidence it is state-aligned and operates out of Asia; no country named). In roughly a year it compromised at least 70 government and critical-infrastructure organisations across 37 countries — national law enforcement, border control, ministries of interior, foreign affairs, finance and energy, elected officials and national telecoms — and between Nov and Dec 2025 actively reconnoitred government infrastructure in 155 countries. Uses phishing, exploitation kits, custom malware (Diaoyu loader, ShadowGuard Linux rootkit), web shells and tunnelling/proxy tools; prioritises targets with economic-partnership ties to specific regional interests. Attribution: Unit 42 names no state. Reuters (12 Feb 2026) reported, citing unnamed sources, that Palo Alto had linked the activity to China and withheld that for fear of retaliation; Palo Alto dismissed the claim. Treat any China attribution as claimed, not confirmed.

Attribution

Operates out of Asia; no country named

Tracked by researchers; no state or organisation has been publicly attributed.

• Palo Alto Networks Unit 42 (Research, 2026-02-05)
  High confidence: a state-aligned group operating out of Asia

Campaigns 3

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 8

Malware and tools 10

Exploited vulnerabilities 1

Highest CVSS first.

Infrastructure patterns

• C2 servers leased from common, legitimate VPS providers (Unit 42, 2026)

Reporting and advisories 1

• Palo Alto Networks Unit 42
  Shadow Campaigns — government & critical-infrastructure compromises (37 countries)