In 2025 a threat group compromised government and critical infrastructure in 37 countries, with reconnaissance in 155.

Unit42 is a cybersecurity research team known for its  analysis of cyber threats, malware, and cyber attack trends. Through research reports, threat intelligence briefings, and data analysis, Unit42 offers insights into emerging cyber threats and adversary tactics. Readers can learn about threat detection methodologies, vulnerability trends, and cyber attack attribution to enhance their cybersecurity posture and protect their organizations from advanced cyber threats.

Unit 42

Unit 42 researchers uncovered TGR-STA-1030, a state-aligned cyberespionage group operating from Asia that compromised government and critical infrastructure in 37 countries over the past year. The group targets ministries of finance, law enforcement, and economic departments using phishing campaigns, N-day exploits, and custom tooling including a new Linux eBPF rootkit called ShadowGuard. The attackers employ multi-tiered infrastructure with VPS servers in the US, UK, and Singapore, and leverage C2 frameworks like Cobalt Strike and VShell. Reconnaissance activity spanned 155 countries between November-December 2025, with targeting patterns correlating to economic partnerships, trade agreements, and mining interests. The report provides technical analysis of the Diaoyu Loader phishing tool, exploitation techniques, web shells, and defensive indicators for network defenders.

The Shadow Campaigns: Uncovering Global Espionage