A state-aligned Asian cyberespionage group breached at least 70 organizations across 37 countries in a wide-reaching campaign targeting government and critical infrastructure since 2025.

Cyber & Information WarfareCyber AttacksHacking, malware, ransomware

Aggressor

Summary

Between early 2025 and early 2026, a massive cyberespionage campaign attributed to a state-aligned group operating from Asia compromised over 70 organizations in 37 countries. The group, named TGR-STA-1030 by Palo Alto Networks, targeted key government entities including law enforcement, border control, ministries of finance, and agencies related to diplomacy, trade, and natural resources. Notable targets included Brazil's Ministry of Mines and Energy, the Czech Republic's parliament and army, an Indonesian government official, and Taiwan's power equipment suppliers. The attackers used phishing and vulnerability exploitation, deploying a new Linux kernel rootkit to evade detection and maintain persistent access. The group conducted reconnaissance in 155 countries, scanning for future targets, and showed interest in economic intelligence focusing on mining, rare earths, trade policy, and diplomacy. This ongoing campaign has potential long-term national security consequences, with the group still active and targeting critical government infrastructure globally. Palo Alto Networks has engaged with affected countries and warned that the group remains a threat internationally.

Classification

Confidence: High

The article clearly describes a hostile cyberespionage campaign by a state-aligned Asian hacking group targeting multiple governments and critical infrastructure, constituting aggressor activity. No defense preparation or response actions are described.

Source URL

https://axios.com/2026/02/05/cyberespionage-government-hacking-campaign-palo-alto-networks

Open source

Provenance

Publisher: extension
Submitted: Feb 14, 2026, 12:22 UTC
Last updated: Nov 4, 2026, 08:35 UTC
Event time: Feb 5, 2026, 11:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "750c9770-0a51-43cc-9122-3cd1b617a67b",
  "url": "https://axios.com/2026/02/05/cyberespionage-government-hacking-campaign-palo-alto-networks",
  "source": "extension",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Hacking, malware, ransomware",
  "country": "Brazil",
  "source_reliability": "C",
  "info_credibility": "3",
  "tags": [
    "offensive cyber operations",
    "state-aligned hacking",
    "TGR-STA-1030",
    "phishing",
    "Linux rootkit",
    "economic intelligence",
    "government hacking",
    "Palo Alto Networks",
    "Asia",
    "SolarWinds comparison"
  ],
  "nodes": [
    "Node 1: Borders"
  ],
  "countries": [
    "Brazil"
  ],
  "where_text": "Cyberspace",
  "headline": null,
  "description": "Palo Alto Networks announced a massive cyberespionage campaign by a state-aligned Asian group compromising at least 70 organizations across 37 countries from 2025 through early 2026. The group, TGR-STA-1030, infiltrated national law enforcement, border control, finance ministries, and diplomatic agencies in countries including Brazil, the Czech Republic, Indonesia, Taiwan, Bolivia, Mexico, Panama, Venezuela, Cyprus, Greece, Malaysia, Mongolia, the DRC, Djibouti, and Zambia, among others. The campaign relied on phishing and exploitation of known software vulnerabilities. Researchers detected lateral movement within networks and use of a previously unknown Linux kernel rootkit for stealth and persistence. The campaign appeared focused on economic intelligence, particularly on mining, rare earths, trade, and diplomacy. Targeted attacks corresponded to geopolitical events such as U.S. capture of Nicolás Maduro and trade investigations in Mexico. The group continues active reconnaissance of governments including Australia, Afghanistan, and Nepal. The U.S. and U.K. agencies were reportedly not affected. Palo Alto Networks has been coordinating with affected countries and industry partners. The operation represents the broadest single-government hacking campaign since SolarWinds in 2020.",
  "summary_short": "A state-aligned Asian cyberespionage group breached at least 70 organizations across 37 countries in a wide-reaching campaign targeting government and critical infrastructure since 2025.",
  "summary_extended": "Between early 2025 and early 2026, a massive cyberespionage campaign attributed to a state-aligned group operating from Asia compromised over 70 organizations in 37 countries. The group, named TGR-STA-1030 by Palo Alto Networks, targeted key government entities including law enforcement, border control, ministries of finance, and agencies related to diplomacy, trade, and natural resources. Notable targets included Brazil's Ministry of Mines and Energy, the Czech Republic's parliament and army, an Indonesian government official, and Taiwan's power equipment suppliers. The attackers used phishing and vulnerability exploitation, deploying a new Linux kernel rootkit to evade detection and maintain persistent access. The group conducted reconnaissance in 155 countries, scanning for future targets, and showed interest in economic intelligence focusing on mining, rare earths, trade policy, and diplomacy. This ongoing campaign has potential long-term national security consequences, with the group still active and targeting critical government infrastructure globally. Palo Alto Networks has engaged with affected countries and warned that the group remains a threat internationally.",
  "actor_primary": "TGR-STA-1030",
  "target_primary": null,
  "location_text": "Brazil's Ministry of Mines and Energy, Czech Republic's parliament and army, Indonesian government official, Taiwanese power equipment supplier",
  "location_region": null,
  "location_coordinates_lat": -14.235004,
  "location_coordinates_lon": -51.92528,
  "location_precision": "Regional",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The article clearly describes a hostile cyberespionage campaign by a state-aligned Asian hacking group targeting multiple governments and critical infrastructure, constituting aggressor activity. No defense preparation or response actions are described.",
  "event_time_utc": "2026-02-05T11:00:06.000Z",
  "end_time_utc": null,
  "event_time_confidence": "unknown",
  "created_at": "2026-02-14T12:22:52.105Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "regional",
  "time_precision_band": "unknown",
  "severity_band": "significant",
  "attribution_confidence_band": "low",
  "attribution_basis": "single_source"
}

Public assessmentReliability: StrongSeverity: SignificantAttribution: LowSingle sourceTime: UnknownLocation: Regional

Source reliability

Info credibility

Event time

Feb 5, 2026, 11:00 UTC

Event time confidence

unknown

Location

Brazil's Ministry of Mines and Energy, Czech Republic's parliament and army, Indonesian government official, Taiwanese power equipment supplier

Primary actor

TGR-STA-1030

Country

Brazil

Countries

Brazil

Tags

offensive cyber operations, state-aligned hacking, TGR-STA-1030, phishing, Linux rootkit, economic intelligence, government hacking, Palo Alto Networks, Asia, SolarWinds comparison

Nodes

Node 1: Borders

Loading signal...

{ "id": "750c9770-0a51-43cc-9122-3cd1b617a67b", "url": "https://axios.com/2026/02/05/cyberespionage-government-hacking-campaign-palo-alto-networks", "source": "extension", "status": "approved", "category": "Cyber & Information Warfare", "subcategory": "Cyber Attacks", "incident_type": "Hacking, malware, ransomware", "country": "Brazil", "source_reliability": "C", "info_credibility": "3", "tags": [ "offensive cyber operations", "state-aligned hacking", "TGR-STA-1030", "phishing", "Linux rootkit", "economic intelligence", "government hacking", "Palo Alto Networks", "Asia", "SolarWinds comparison" ], "nodes": [ "Node 1: Borders" ], "countries": [ "Brazil" ], "where_text": "Cyberspace", "headline": null, "description": "Palo Alto Networks announced a massive cyberespionage campaign by a state-aligned Asian group compromising at least 70 organizations across 37 countries from 2025 through early 2026. The group, TGR-STA-1030, infiltrated national law enforcement, border control, finance ministries, and diplomatic agencies in countries including Brazil, the Czech Republic, Indonesia, Taiwan, Bolivia, Mexico, Panama, Venezuela, Cyprus, Greece, Malaysia, Mongolia, the DRC, Djibouti, and Zambia, among others. The campaign relied on phishing and exploitation of known software vulnerabilities. Researchers detected lateral movement within networks and use of a previously unknown Linux kernel rootkit for stealth and persistence. The campaign appeared focused on economic intelligence, particularly on mining, rare earths, trade, and diplomacy. Targeted attacks corresponded to geopolitical events such as U.S. capture of Nicolás Maduro and trade investigations in Mexico. The group continues active reconnaissance of governments including Australia, Afghanistan, and Nepal. The U.S. and U.K. agencies were reportedly not affected. Palo Alto Networks has been coordinating with affected countries and industry partners. The operation represents the broadest single-government hacking campaign since SolarWinds in 2020.", "summary_short": "A state-aligned Asian cyberespionage group breached at least 70 organizations across 37 countries in a wide-reaching campaign targeting government and critical infrastructure since 2025.", "summary_extended": "Between early 2025 and early 2026, a massive cyberespionage campaign attributed to a state-aligned group operating from Asia compromised over 70 organizations in 37 countries. The group, named TGR-STA-1030 by Palo Alto Networks, targeted key government entities including law enforcement, border control, ministries of finance, and agencies related to diplomacy, trade, and natural resources. Notable targets included Brazil's Ministry of Mines and Energy, the Czech Republic's parliament and army, an Indonesian government official, and Taiwan's power equipment suppliers. The attackers used phishing and vulnerability exploitation, deploying a new Linux kernel rootkit to evade detection and maintain persistent access. The group conducted reconnaissance in 155 countries, scanning for future targets, and showed interest in economic intelligence focusing on mining, rare earths, trade policy, and diplomacy. This ongoing campaign has potential long-term national security consequences, with the group still active and targeting critical government infrastructure globally. Palo Alto Networks has engaged with affected countries and warned that the group remains a threat internationally.", "actor_primary": "TGR-STA-1030", "target_primary": null, "location_text": "Brazil's Ministry of Mines and Energy, Czech Republic's parliament and army, Indonesian government official, Taiwanese power equipment supplier", "location_region": null, "location_coordinates_lat": -14.235004, "location_coordinates_lon": -51.92528, "location_precision": "Regional", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The article clearly describes a hostile cyberespionage campaign by a state-aligned Asian hacking group targeting multiple governments and critical infrastructure, constituting aggressor activity. No defense preparation or response actions are described.", "event_time_utc": "2026-02-05T11:00:06.000Z", "end_time_utc": null, "event_time_confidence": "unknown", "created_at": "2026-02-14T12:22:52.105Z", "updated_at": "2026-11-04T08:35:32.139Z", "reliability_band": "strong", "location_precision_band": "regional", "time_precision_band": "unknown", "severity_band": "significant", "attribution_confidence_band": "low", "attribution_basis": "single_source" }