InfoSecBulletin Cybersecurity for mankind
According to Palo Alto Networks, a state-backed hacking group compromised government and critical infrastructure systems worldwide. The security firm identifies the threat actor as TGR-STA-1030, and their recent activity is dubbed as the Shadow Campaign.
Palo Alto Networks expressed high confidence that it’s a nation-state group operating out of Asia based on the use of regional tools and services, language preferences, targets, and operational infrastructure located in the region. The security firm hasn’t named a specific country for Shadow Campaign, but its activities suggest it resembles a Chinese threat actor.
Contract and server dispute brought down Bangladesh’s digital payment
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
“Palo Alto Networks Unit 42 confirmed that the threat actor successfully accessed and exfiltrated sensitive data from victim email servers,” Unit 42 Director of National Security Programs Pete Renals told The Register. “This included financial negotiations and contracts, banking and account information, and critical military-related operational updates.”
“The Cybersecurity and Infrastructure Security Agency is aware of the hacking group identified as TGR-STA-1030 by Palo Alto Networks,” a CISA spokesperson told The Register. “We are working with our government, industry, and international partners to rapidly detect and mitigate any exploitation of the vulnerabilities identified in the report.”
Palo Alto researchers found that TGR-STA-1030 has hacked at least 70 organizations in 37 countries. The hackers have also been surveying government systems in 155 countries.
Targets included national law enforcement, border control agencies, finance ministries, and government departments related to trade, natural resources, and diplomacy.
“This group compromised one nation’s parliament and a senior elected official of another. It also compromised national-level telecommunications companies and several national police and counter-terrorism organizations,” Palo Alto Networks said.
It added, “While this group might be pursuing espionage objectives, its methods, targets and scale of operations are alarming, with potential long-term consequences for national security and key services.”
The security firm has tracked TGR-STA-1030 since early 2025, initially targeting European governments, but evidence indicates it may have been active since January 2024.
Initial access, malware, and vulnerability exploitation:
Hackers gained entry to targeted organizations using advanced email phishing tactics to convince recipients to install malware. The malware loader in the Shadow Campaign checks for only five security products, unlike many loaders that check for many. This helps it evade detection.
The threat actor employs various tools, with the most significant being ShadowGuard, a Linux kernel rootkit identified by Palo Alto. It allows attackers to alter system data and stay undetected.
Palo Alto has observed attempts to exploit known vulnerabilities in products from Microsoft, SAP, Atlassian, D-Link, Apache, Commvault, and several Chinese vendors, but there’s no evidence of zero-day vulnerabilities being exploited.
Indicators of Compromise:
IP Addresses
138.197.44[.]208
142.91.105[.]172
146.190.152[.]219
157.230.34[.]45
157.245.194[.]54
159.65.156[.]200
159.203.164[.]101
178.128.60[.]22
178.128.109[.]37
188.127.251[.]171
188.166.210[.]146
208.85.21[.]30
Palo Alto Networks found that the group uses various command-and-control (C2) frameworks typical for their region to move laterally and maintain access in compromised systems.
8.7 billion records leaked: Inside the huge Chinese data breach
