The Shadow Campaigns: Uncovering global espionage

Palo Alto Networks released a report Thursday on its investigation into “the Shadow Campaigns” that unveiled a new cyberespionage group tracked by Unit 42 as TGR-STA-1030.

Unit 42 assesses with high confidence that TGR-STA-1030 is a state-aligned group that operates out of Asia. Over the past year, this group has compromised government and critical infrastructure organizations across 37 countries. This means that approximately one out of every five countries has experienced a critical breach from this group in the past year. Further, between November and December 2025, Unit 42 observed the group conducting active reconnaissance against government infrastructure associated with 155 countries.

This group primarily targets government ministries and departments. 

Read more at Unit 42