Asian State-Backed Group TGR-STA-1030 Breaches 70 Government, Infrastructure Entities

**Executive summary:** Palo Alto Networks Unit 42 has identified a previously undocumented, state-motivated espionage group dubbed TGR-STA-1030 (assessed Asian origin) that since January 2024 has compromised at least 70 government and critical-infrastructure organizations across 37 countries, using phishing-delivered Diaoyu Loader, Cobalt Strike, web shells, N-day exploits, and an eBPF-based Linux rootkit (ShadowGuard) to maintain long-term access and exfiltrate sensitive email, financial, and military-related data.