Unit 42 researchers have uncovered an advanced, state-aligned cyber espionage group known as TGR-STA-1030, operating from Asia. This group has compromised government and critical infrastructure networks across 37 countries over the past year, specifically targeting ministries of finance, law enforcement, and economic departments. These attacks have been linked to broader geopolitical events, economic partnerships, trade agreements, and mining interests.
TGR-STA-1030 employs a comprehensive set of infiltration techniques, including phishing campaigns, N-day exploits, and custom malware. One of their most notable tools is a new Linux eBPF rootkit named ShadowGuard, which is designed to hide processes and files at the kernel level. Additionally, they leverage Cobalt Strike and other Command and Control (C2) frameworks, alongside various web shells, to maintain persistence and exfiltrate data.
Their multi-tiered infrastructure involves leasing VPS servers in the US, UK, and Singapore to disguise their operations and complicate the investigation process. The group’s reconnaissance activities were especially intense between November and December 2025, covering 155 countries.
The attackers exploit known vulnerabilities in software products such as SAP, Microsoft Exchange, and Atlassian, which allow them to gain unauthorized access and maintain long-term presence in compromised networks. Sensitive data exfiltrated includes financial negotiations, banking information, and military operational updates.
In response to this threat, CISA and other international cybersecurity partners are collaborating to mitigate the impact and prevent future breaches. Network defenders are urged to look for technical indicators of compromise, including signs of the Diaoyu Loader phishing tool, ShadowGuard rootkit, and associated tunneling techniques used to conceal malicious traffic through legitimate-looking infrastructure.

Collections

Unit 42 researchers discovered TGR-STA-1030, an Asia-based state-aligned cyber espionage group that compromised government and critical infrastructure networks in 37 countries. The group uses sophisticated techniques including phishing, N-day exploits, and a custom Linux eBPF rootkit called ShadowGuard that hides processes at the kernel level. They exploit vulnerabilities in SAP, Microsoft Exchange, and Atlassian products, using Cobalt Strike and web shells for persistence. The attackers operate through VPS servers in multiple countries to obscure their activities and have exfiltrated sensitive financial, banking, and military data. CISA and international partners are coordinating response efforts.

Exposing TGR-STA-1030: A Global Cyberespionage Threat