Asia-based government spies quietly broke into critical networks across 37 countries
(2026/02/05)
- Reference: 1770319293
- News link: https://www.theregister.co.uk/2026/02/05/asia_government_spies_hacked_37_critical_networks/
- Source link:
A state-aligned cyber group in Asia compromised government and critical infrastructure organizations across 37 countries in an ongoing espionage campaign, according to security researchers.
In total, the crew compromised at least 70 organizations, and maintained access to several of these for months.
"While this group might be pursuing espionage objectives, its methods, targets and scale of operations are alarming, with potential long-term consequences for national security and key services," Palo Alto Networks' Unit 42 cyber sleuths [1]said in research published on Wednesday.
[2]
Successful break-ins included five national police or border control entities, one nation's parliament, a senior elected official, and national telecommunications companies. The spies also broke into systems belonging to three ministries of finance and other government agencies.
[3]
[4]
"Palo Alto Networks Unit 42 confirmed that the threat actor successfully accessed and exfiltrated sensitive data from victim email servers," Unit 42 Director of National Security Programs Pete Renals told The Register . "This included financial negotiations and contracts, banking and account information, and critical military-related operational updates."
Renals said the cyber investigation team is not attributing the digital intrusions to a specific Asian country.
The Cybersecurity and Infrastructure Security Agency is aware of the hacking group identified as TGR-STA-1030 by Palo Alto Networks
Unit 42 tracks the new group as TGR-STA-1030, and said they also observed the spies conducting "active reconnaissance" against 155 governments across the Americas, Europe, Asia, and Africa between November and December 2025. The researchers also documented a "concerted focus" on Germany in July 2025, during which the snoops initiated connections to over 490 IP addresses hosting government infrastructure.
While Renals declined to provide details about specific reconnaissance targets in the US, "more broadly across the board, we saw the actor routinely focus on ministries of finance, economy, defense, foreign affairs and commerce," he said.
[5]
The FBI did not respond to our requests for comment, but the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that it is also tracking this cyber-espionage crew.
"The Cybersecurity and Infrastructure Security Agency is aware of the hacking group identified as TGR-STA-1030 by Palo Alto Networks," a CISA spokesperson told The Register . "We are working with our government, industry, and international partners to rapidly detect and mitigate any exploitation of the vulnerabilities identified in the report."
The cyberspies use phishing emails and known vulnerabilities in Microsoft Exchange, SAP, and Atlassian products to gain initial access to victim organizations.
[6]
In February 2025, Unit 42 spotted phishing campaigns targeting European governments and using lures related to ministry or department reorganization that included links to malicious files hosted on mega[.]nz. The threat hunters note that one Estonian government entity also observed this campaign and uploaded a related [7]ZIP archive to VirusTotal's malware repository.
The Estonian filename translates to "Changes to the organizational structure of the Police and Border Guard Board."
Unit 42 analyzed the archive's contents and found it contained a malware loader with the original name "DiaoYu.exe." This translates to fishing - or phishing in this context. While most loaders check for dozens of antivirus products, this one only checks for five: Kaspersky, Avira, Bitdefender, SentinelOne, and Symantec.
This gives the malware a minimal code footprint and could be a means to help it avoid being detected by security filters.
[8]Critical SolarWinds Web Help Desk bug under attack
[9]AWS intruder achieved admin access in under 10 minutes thanks to AI assist, researchers say
[10]Italy claims cyberattacks 'of Russian origin' are pelting Winter Olympics
[11]Three clues that your LLM may be poisoned with a sleeper-agent back door
The investigation also uncovered a new Linux kernel rootkit called ShadowGuard, believed to be unique to this particular nation-state group. It's a stealthy Extended Berkeley Packet Filter (eBPF) backdoor that hides process information, directories, and files at the kernel level, which makes it very difficult to detect.
TGR-STA-1030 also used real-world geopolitical events in its campaigns, including the US government shutdown that began in October 2025 - during which Unit 42 observed the spies scanning government infrastructure across North, Central, and South America.
In another case, the researchers say in August 2025, Czech President Petr Pavel privately met with the Dalai Lama during a trip to India, and in the following weeks, the snoop crew began scanning Czech infrastructure across the army, police, parliament, and ministries of interior, finance, and foreign affairs.
Additionally, soon after January 3, when an American military operation captured Venezuelan President Nicolás Maduro and his wife, the snoops conducted "extensive reconnaissance activities targeting at least 140 government-owned IP addresses," according to Unit 42.
This new nation-state group "remains an active threat to government and critical infrastructure worldwide," the researchers said. ®
Get our [12]Tech Resources
[1] https://unit42.paloaltonetworks.com/shadow-campaigns-uncovering-global-espionage/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aYUhET6bEVXH9gHcNHlzYwAAApg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aYUhET6bEVXH9gHcNHlzYwAAApg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aYUhET6bEVXH9gHcNHlzYwAAApg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aYUhET6bEVXH9gHcNHlzYwAAApg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aYUhET6bEVXH9gHcNHlzYwAAApg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://www.virustotal.com/gui/file/66ec547b97072828534d43022d766e06c17fc1cafe47fbd9d1ffc22e2d52a9c0
[8] https://www.theregister.com/2026/02/04/critical_solarwinds_web_help_desk/
[9] https://www.theregister.com/2026/02/04/aws_cloud_breakin_ai_assist/
[10] https://www.theregister.com/2026/02/05/winter_olympics_russian_attacks/
[11] https://www.theregister.com/2026/02/05/llm_poisoned_how_to_tell/
[12] https://whitepapers.theregister.com/
In total, the crew compromised at least 70 organizations, and maintained access to several of these for months.
"While this group might be pursuing espionage objectives, its methods, targets and scale of operations are alarming, with potential long-term consequences for national security and key services," Palo Alto Networks' Unit 42 cyber sleuths [1]said in research published on Wednesday.
[2]
Successful break-ins included five national police or border control entities, one nation's parliament, a senior elected official, and national telecommunications companies. The spies also broke into systems belonging to three ministries of finance and other government agencies.
[3]
[4]
"Palo Alto Networks Unit 42 confirmed that the threat actor successfully accessed and exfiltrated sensitive data from victim email servers," Unit 42 Director of National Security Programs Pete Renals told The Register . "This included financial negotiations and contracts, banking and account information, and critical military-related operational updates."
Renals said the cyber investigation team is not attributing the digital intrusions to a specific Asian country.
The Cybersecurity and Infrastructure Security Agency is aware of the hacking group identified as TGR-STA-1030 by Palo Alto Networks
Unit 42 tracks the new group as TGR-STA-1030, and said they also observed the spies conducting "active reconnaissance" against 155 governments across the Americas, Europe, Asia, and Africa between November and December 2025. The researchers also documented a "concerted focus" on Germany in July 2025, during which the snoops initiated connections to over 490 IP addresses hosting government infrastructure.
While Renals declined to provide details about specific reconnaissance targets in the US, "more broadly across the board, we saw the actor routinely focus on ministries of finance, economy, defense, foreign affairs and commerce," he said.
[5]
The FBI did not respond to our requests for comment, but the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that it is also tracking this cyber-espionage crew.
"The Cybersecurity and Infrastructure Security Agency is aware of the hacking group identified as TGR-STA-1030 by Palo Alto Networks," a CISA spokesperson told The Register . "We are working with our government, industry, and international partners to rapidly detect and mitigate any exploitation of the vulnerabilities identified in the report."
The cyberspies use phishing emails and known vulnerabilities in Microsoft Exchange, SAP, and Atlassian products to gain initial access to victim organizations.
[6]
In February 2025, Unit 42 spotted phishing campaigns targeting European governments and using lures related to ministry or department reorganization that included links to malicious files hosted on mega[.]nz. The threat hunters note that one Estonian government entity also observed this campaign and uploaded a related [7]ZIP archive to VirusTotal's malware repository.
The Estonian filename translates to "Changes to the organizational structure of the Police and Border Guard Board."
Unit 42 analyzed the archive's contents and found it contained a malware loader with the original name "DiaoYu.exe." This translates to fishing - or phishing in this context. While most loaders check for dozens of antivirus products, this one only checks for five: Kaspersky, Avira, Bitdefender, SentinelOne, and Symantec.
This gives the malware a minimal code footprint and could be a means to help it avoid being detected by security filters.
[8]Critical SolarWinds Web Help Desk bug under attack
[9]AWS intruder achieved admin access in under 10 minutes thanks to AI assist, researchers say
[10]Italy claims cyberattacks 'of Russian origin' are pelting Winter Olympics
[11]Three clues that your LLM may be poisoned with a sleeper-agent back door
The investigation also uncovered a new Linux kernel rootkit called ShadowGuard, believed to be unique to this particular nation-state group. It's a stealthy Extended Berkeley Packet Filter (eBPF) backdoor that hides process information, directories, and files at the kernel level, which makes it very difficult to detect.
TGR-STA-1030 also used real-world geopolitical events in its campaigns, including the US government shutdown that began in October 2025 - during which Unit 42 observed the spies scanning government infrastructure across North, Central, and South America.
In another case, the researchers say in August 2025, Czech President Petr Pavel privately met with the Dalai Lama during a trip to India, and in the following weeks, the snoop crew began scanning Czech infrastructure across the army, police, parliament, and ministries of interior, finance, and foreign affairs.
Additionally, soon after January 3, when an American military operation captured Venezuelan President Nicolás Maduro and his wife, the snoops conducted "extensive reconnaissance activities targeting at least 140 government-owned IP addresses," according to Unit 42.
This new nation-state group "remains an active threat to government and critical infrastructure worldwide," the researchers said. ®
Get our [12]Tech Resources
[1] https://unit42.paloaltonetworks.com/shadow-campaigns-uncovering-global-espionage/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aYUhET6bEVXH9gHcNHlzYwAAApg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aYUhET6bEVXH9gHcNHlzYwAAApg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aYUhET6bEVXH9gHcNHlzYwAAApg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aYUhET6bEVXH9gHcNHlzYwAAApg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aYUhET6bEVXH9gHcNHlzYwAAApg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://www.virustotal.com/gui/file/66ec547b97072828534d43022d766e06c17fc1cafe47fbd9d1ffc22e2d52a9c0
[8] https://www.theregister.com/2026/02/04/critical_solarwinds_web_help_desk/
[9] https://www.theregister.com/2026/02/04/aws_cloud_breakin_ai_assist/
[10] https://www.theregister.com/2026/02/05/winter_olympics_russian_attacks/
[11] https://www.theregister.com/2026/02/05/llm_poisoned_how_to_tell/
[12] https://whitepapers.theregister.com/
Palo Alto
VoiceOfTruth
>> Unit 42 spotted phishing campaigns targeting European governments
Hmmm. Does Palo Alto spot American campaigns target European governments? I thought not...
What they actually said :
PhilipN
" high confidence that TGR-STA-1030 is a state-aligned group that operates out of Asia.."
Great! Asia goes from Istanbul to Vladivostok. Whatever hobbies you have guys do NOT make it pub darts.
Re: What they actually said :
AVR
If they're specifically interested in people who talk to the Dalai Lama you can narrow it down a bit with a few seconds thought. Not to the level of 'no reasonable doubt', but a very solid suspicion.
Question
elsergiovolador
broke into critical networks
Critical of what?
Vocabulary correction
VoiceOfTruth
>> an American military operation captured Venezuelan President Nicolás Maduro and his wife
Kidnapped after an illegal invasion.
Headlines
Oddly enough the statement that didn't make headlines was:
The cyberspies use phishing emails and known vulnerabilities in Microsoft Exchange, SAP, and Atlassian products to gain initial access to victim organizations.
Are they so common now as not to be newsworthy? Maybe another wake-up call to those wedded to MS products?