A state-aligned Asian cyberespionage group breached at least 70 organizations across 37 countries in a wide-reaching campaign targeting government and critical infrastructure since 2025.

Between early 2025 and early 2026, a massive cyberespionage campaign attributed to a state-aligned group operating from Asia compromised over 70 organizations in 37 countries. The group, named TGR-STA-1030 by Palo Alto Networks, targeted key government entities including law enforcement, border control, ministries of finance, and agencies related to diplomacy, trade, and natural resources. Notable targets included Brazil's Ministry of Mines and Energy, the Czech Republic's parliament and army, an Indonesian government official, and Taiwan's power equipment suppliers. The attackers used phishing and vulnerability exploitation, deploying a new Linux kernel rootkit to evade detection and maintain persistent access. The group conducted reconnaissance in 155 countries, scanning for future targets, and showed interest in economic intelligence focusing on mining, rare earths, trade policy, and diplomacy. This ongoing campaign has potential long-term national security consequences, with the group still active and targeting critical government infrastructure globally. Palo Alto Networks has engaged with affected countries and warned that the group remains a threat internationally.