State actor targets 155 countries in 'Shadow Campaigns' espionage op

Unit 42 attributes a global, state-sponsored espionage operation called "Shadow Campaigns" to an actor tracked as TGR-STA-1030/UNC6619, reporting at least 70 confirmed compromises across 37 countries and reconnaissance targeting entities connected to 155 countries; victims include government ministries, critical infrastructure and diplomatic bodies. The actor used tailored phishing (malicious archives on Mega.nz with a Diaoyu loader that fetches Cobalt Strike and VShell), exploitation of ~15 known vulnerabilities, webshells and tunneling tools, and a custom Linux eBPF rootkit (“ShadowGuard”) to maintain stealthy persistence; IoCs and TTPs are provided for detection and mitigation.