--- title: The Shadow Campaigns: Uncovering Global Espionage description: Unit 42 researchers uncovered TGR-STA-1030, a state-aligned cyberespionage group operating from Asia that compromised government and critical infrastructure in... canonical: https://daily.dev/posts/the-shadow-campaigns-uncovering-global-espionage-rfa3odf9o twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The Shadow Campaigns: Uncovering Global Espionage | daily.dev og:description: Unit 42 researchers uncovered TGR-STA-1030, a state-aligned cyberespionage group operating from Asia that compromised government and critical infrastructure in... og:url: https://daily.dev/posts/the-shadow-campaigns-uncovering-global-espionage-rfa3odf9o og:image: https://api.daily.dev/og/posts/RFa3oDF9o.png og:image:alt: The Shadow Campaigns: Uncovering Global Espionage og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The Shadow Campaigns: Uncovering Global Espionage **[Unit 42](https://daily.dev/sources/unit42)** · 25 min read · 0 upvotes · 0 comments ## Summary Unit 42 researchers uncovered TGR-STA-1030, a state-aligned cyberespionage group operating from Asia that compromised government and critical infrastructure in 37 countries over the past year. The group targets ministries of finance, law enforcement, and economic departments using phishing campaigns, N-day exploits, and custom tooling including a new Linux eBPF rootkit called ShadowGuard. The attackers employ multi-tiered infrastructure with VPS servers in the US, UK, and Singapore, and leverage C2 frameworks like Cobalt Strike and VShell. Reconnaissance activity spanned 155 countries between November-December 2025, with targeting patterns correlating to economic partnerships, trade agreements, and mining interests. The report provides technical analysis of the Diaoyu Loader phishing tool, exploitation techniques, web shells, and defensive indicators for network defenders. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Chinese spy group caught lurking in Poland, Asia networks](https://daily.dev/posts/chinese-spy-group-caught-lurking-in-poland-asia-networks-9camnlgtt) · The Register · 1 upvotes · 0 comments - [Converging Interests: Analysis of Threat Clusters Targeting a Southeast Asian Government](https://daily.dev/posts/converging-interests-analysis-of-threat-clusters-targeting-a-southeast-asian-government-vcgd8dciw) · Unit 42 · 0 upvotes · 0 comments - [TAG-193’s Regional Espionage Operations](https://daily.dev/posts/tag-193-s-regional-espionage-operations-msjq5somv) · Recorded Future Blog · 0 upvotes · 0 comments - [Chinese Hackers Owned Southeast Asian Military Orgs for Years](https://daily.dev/posts/chinese-hackers-owned-southeast-asian-military-orgs-for-years-6twaxiz2m) · Dark Reading · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#linux](https://daily.dev/tags/linux), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/the-shadow-campaigns-uncovering-global-espionage-rfa3odf9o) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The Shadow Campaigns: Uncovering Global Espionage","url":"https://daily.dev/posts/the-shadow-campaigns-uncovering-global-espionage-rfa3odf9o","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-shadow-campaigns-uncovering-global-espionage-rfa3odf9o"},"datePublished":"2026-02-05T11:07:00.575Z","dateModified":"2026-02-26T21:12:49.181Z","description":"Unit 42 researchers uncovered TGR-STA-1030, a state-aligned cyberespionage group operating from Asia that compromised government and critical infrastructure in...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/61343efd24b45e8089ed3004a3660396?_a=AQAEulh","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/61343efd24b45e8089ed3004a3660396?_a=AQAEulh","isAccessibleForFree":true,"articleSection":"Unit 42","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Unit 42","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/5b55ca8d2ae04181939041fbc9d78160","url":"https://daily.dev/sources/unit42"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-shadow-campaigns-uncovering-global-espionage-rfa3odf9o","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,linux,malware","timeRequired":"PT25M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Unit 42","item":"https://daily.dev/sources/unit42"},{"@type":"ListItem","position":3,"name":"The Shadow Campaigns: Uncovering Global Espionage"}]} ```