Loading threat actor…
TGR-STA-1030, also tracked as UNC6619, is a state-aligned cyber espionage group assessed with high confidence to operate out of Asia and widely reported as China-linked, although some public reporting stops short of definitive state attribution. The group is associated with a broad, ongoing espionage operation known as the Shadow Campaigns and has been active since at least January 2024. It has compromised at least 70 government and critical infrastructure organizations across 37 countries and conducted reconnaissance against government infrastructure associated with 155 countries, making it one of the most expansive single-actor espionage campaigns publicly documented in recent years. The actor primarily targets government ministries, law enforcement and border-control entities, ministries of finance, diplomatic and trade bodies, parliaments, telecommunications providers, energy-related organizations, mining interests, and other critical infrastructure. Reported targeting patterns indicate a strong interest in strategic, economic, political, military, and diplomatic intelligence, including trade negotiations, natural resources, and regional geopolitical relationships. Activity has been observed globally, with especially notable operations in Europe, Asia, Africa, and more recently Central and South America. TGR-STA-1030 gains initial access through tailored phishing and exploitation of known public-facing vulnerabilities rather than zero-days. Phishing operations have used lures themed around internal government matters such as ministry reorganization. The group has also attempted exploitation of vulnerabilities affecting enterprise technologies including Microsoft Exchange, SAP, Atlassian products, Microsoft OMI, Struts2, Commvault, and other internet-facing systems, alongside directory traversal and SQL injection activity. Researchers have reported no evidence that the group developed or used zero-day exploits in the documented campaign. Its post-compromise tradecraft is mature and varied. Observed tooling includes multiple command-and-control frameworks such as Cobalt Strike, VShell, Havoc, Sliver, and SparkRAT; web shells including Behinder, Godzilla, and Neo-reGeorg; and tunneling or proxy utilities such as GOST, FRPS, and IOX. The group has also been linked to a custom malware loader known as Diaoyu Loader, which incorporates anti-analysis checks and security-product awareness before retrieving follow-on payloads. A notable capability is ShadowGuard, a Linux eBPF kernel rootkit assessed as unique to this actor in public reporting, used to hide processes and artifacts and support stealthy long-term access. TGR-STA-1030 has demonstrated persistence in victim environments for months, enabling sustained intelligence collection and exfiltration from email servers and file shares. Reported stolen data includes financial negotiations, contracts, banking-related information, and military-related operational updates. The actor also conducts broad reconnaissance and scanning at scale and appears to align some targeting and operational timing with geopolitical events and policy developments relevant to its intelligence priorities. Overall, TGR-STA-1030 is an operationally mature, state-aligned espionage actor focused on long-duration access, stealth, and strategic intelligence collection against governments and critical infrastructure worldwide.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
30 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
14 malware families attributed to this actor across reporting.
9 additional families tracked in Mallory.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Threat group documented as breaching at least 70 government and critical infrastructure organizations across 37 countries; overlaps with NegativeGlimmer.
Active threat group conducting widespread operations across multiple countries, with recent activity heavily focused on Central and South America.
State-aligned cyberespionage activity cluster conducting broad reconnaissance and compromises of government and critical infrastructure across dozens of countries, with interest in economic partnerships and natural resources.
Named espionage campaign targeting government and critical infrastructure across many countries; attribution to China was discussed but not made by the cited vendor in this content; tooling noted aligns with prior China-nexus intrusions.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.