Shadow Campaigns Expose 37 Nations to State-Linked Cyber Espionage Operations

 

A state-backed cyber espionage effort known as the “Shadow Campaigns” has quietly breached government bodies and critical infrastructure across 37 countries. Investigators from Palo Alto Networks’ Unit 42 assess that the activity began by early 2024 and likely originates from Asia. While no formal attribution has been made, the actor is tracked as TGR-STA-1030 or UNC6619. The campaign is marked by stealth and persistence, focusing on long-term intelligence gathering rather than overt disruption. 

At least 70 organizations were confirmed compromised, primarily government ministries and agencies handling finance, trade, energy, mining, immigration, border control, diplomacy, and law enforcement. Victims span multiple regions, including Brazil’s Ministry of Mines and Energy, Mexican and Bolivian government-linked entities, infrastructure in Panama, and agencies across Europe such as those in Germany, Italy, Poland, and Czechia. Other affected organizations include an Indonesian airline, Malaysian government departments, Mongolian law enforcement, a Taiwanese power equipment supplier, and critical infrastructure entities across parts of Africa. 

Reconnaissance activity was even broader. Between November and December, infrastructure linked to 155 countries was scanned. Systems associated with Australia’s Treasury, Afghanistan’s Ministry of Finance, Nepal’s prime minister’s office, and hundreds of European Union and German government IP addresses showed signs of probing. Analysts noted spikes in activity during politically sensitive periods, including the U.S. government shutdown in October 2025 and the lead-up to Honduras’ national election, suggesting interest in geopolitical developments. Initial access often relied on highly targeted phishing emails referencing internal government matters. 

These messages delivered malware via compressed files hosted on Mega.nz, deploying a loader called Diaoyu that could fetch Cobalt Strike and VShell payloads after performing evasion checks. The group also exploited at least 15 known vulnerabilities in products such as Microsoft Exchange Server, SAP Solution Manager, D-Link devices, and Windows systems. A key finding was a custom Linux kernel rootkit, ShadowGuard, which operates at the kernel level to hide malicious activity and evade detection. 

Infrastructure supporting the campaign used legitimate VPS providers in the U.S., Singapore, and the U.K., along with relay servers and anonymization layers. Researchers conclude the actor is highly capable and remains an ongoing threat to governments and critical services worldwide.