Asian Cyber Espionage Campaign Breached 37 Countries

Palo Alto Networks observed a widespread state-aligned cyberespionage campaign (TGR-STA-1030) that compromised government agencies and critical infrastructure across 37 countries and at least 70 organizations; attackers used phishing and exploits of known products (e.g., Microsoft Exchange, SAP Solution Manager) and deployed a novel Linux kernel rootkit, ShadowGuard, to maintain stealth while collecting economic and diplomatic intelligence related to trade, rare earths, and geopolitics.