Palo Alto Networks has identified a state-sponsored cyberespionage group, labeled TGR-STA-1030, conducting what is being dubbed as the Shadow Campaign against government and critical infrastructure across thirty-seven (37) countries. The group is believed to operate out of Asia, aligning with the GMT+8 time zone, and fits the profile of a Chinese threat actor, as reported by Palo Alto Networks. Since early 2025, TGR-STA-1030 has compromised at least seventy (70) organizations and targeted government infrastructure in 155 countries. Their targets include national law enforcement, border control agencies, finance ministries, and departments of trade, natural resources, and diplomacy. The group employs sophisticated email phishing to gain initial access, deploying a malware loader that only checks for five (5) security products to evade detection. Among their tools is ShadowGuard, a Linux kernel rootkit that allows for undetected data modification. Although they have not exploited zero-day vulnerabilities, the group attempts to exploit known flaws in products from Microsoft, SAP, Atlassian, D-Link, Apache, Commvault, and others. The scale and methods of TGR-STA-1030 pose significant long-term threats to national security and key services. CTIX Analyst will continue to monitor the latest emerging threat actor activities and campaigns.