TGR-STA-1030

Also known as Shadow Campaigns

Reports

First seen

Mar 2

Last seen

Jun 1

Motivation

espionage

Targeting

Sectors

government ×1other ×1

Top ATT&CK techniques

T1041 Exfiltration Over C2 Channel ×2T1566 Phishing ×2T1486 Data Encrypted for Impact ×1T1218.009 System Binary Proxy Execution: Regsvcs/Regasm ×1T1568 Dynamic Resolution ×1T1003 OS Credential Dumping ×1T1027 Obfuscated Files or Information ×1T1204.002 User Execution: Malicious File ×1T1190 Exploit Public-Facing Application ×1T1071.001 Application Layer Protocol: Web Protocols ×1T1598 Phishing for Information ×1T1021 Remote Services ×1

Indicators

cve ×6filename ×3domain ×1

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2025-26399 (exploited)CVE-2025-40551 (exploited)CVE-2026-1281 (exploited)CVE-2026-1340 (exploited)CVE-2026-21509 (exploited)CVE-2026-22769 (exploited)

Recent reports

High

China-Aligned Groups Ramp Up Attacks: Dragon Weave Hits Czech Republic & Taiwan

The Hacker NewsJun 1 Medium

TGR-STA-1030: New Activity in Central and South America

Palo Alto Unit 42Apr 24 High

CERT-EU Cyber Brief February 2026: APT28, China espionage, AI supply-chain attacks, Qilin ransomware

CERT-EU Threat IntelMar 2

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.