A state-aligned cyber group in Asia compromised government and critical infrastructure organizations across 37 countries in an ongoing espionage campaign, according to security researchers.

In total, the crew compromised at least 70 organizations, and maintained access to several of these for months.

“While this group might be pursuing espionage objectives, its methods, targets and scale of operations are alarming, with potential long-term consequences for national security and key services,” Palo Alto Networks’ Unit 42 cyber sleuths said in research published on Wednesday. 

Successful break-ins included five national police or border control entities, one nation’s parliament, a senior elected official, and national telecommunications companies. The spies also broke into systems belonging to three ministries of finance and other government agencies.

“Palo Alto Networks Unit 42 confirmed that the threat actor successfully accessed and exfiltrated sensitive data from victim email servers,” Unit 42 Director of National Security Programs Pete Renals told The Register. “This included financial negotiations and contracts, banking and account information, and critical military-related operational updates.”

Renals said the cyber investigation team is not attributing the digital intrusions to a specific Asian country.

The Cybersecurity and Infrastructure Security Agency is aware of the hacking group identified as TGR-STA-1030 by Palo Alto Networks

Unit 42 tracks the new group as TGR-STA-1030, and said they also observed the spies conducting “active reconnaissance” against 155 governments across the Americas, Europe, Asia, and Africa between November and December 2025. The researchers also documented a “concerted focus” on Germany in July 2025, during which the snoops initiated connections to over 490 IP addresses hosting government infrastructure.

While Renals declined to provide details about specific reconnaissance targets in the US, “more broadly across the board, we saw the actor routinely focus on ministries of finance, economy, defense, foreign affairs and commerce,” he said.

The FBI did not respond to our requests for comment, but the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that it is also tracking this cyber-espionage crew.

“The Cybersecurity and Infrastructure Security Agency is aware of the hacking group identified as TGR-STA-1030 by Palo Alto Networks,” a CISA spokesperson told The Register. “We are working with our government, industry, and international partners to rapidly detect and mitigate any exploitation of the vulnerabilities identified in the report.”

The cyberspies use phishing emails and known vulnerabilities in Microsoft Exchange, SAP, and Atlassian products to gain initial access to victim organizations. 

In February 2025, Unit 42 spotted phishing campaigns targeting European governments and using lures related to ministry or department reorganization that included links to malicious files hosted on mega[.]nz. The threat hunters note that one Estonian government entity also observed this campaign and uploaded a related ZIP archive to VirusTotal’s malware repository. 

The Estonian filename translates to “Changes to the organizational structure of the Police and Border Guard Board.”

Unit 42 analyzed the archive’s contents and found it contained a malware loader with the original name “DiaoYu.exe.” This translates to fishing – or phishing in this context. While most loaders check for dozens of antivirus products, this one only checks for five: Kaspersky, Avira, Bitdefender, SentinelOne, and Symantec.

This gives the malware a minimal code footprint and could be a means to help it avoid being detected by security filters.

The investigation also uncovered a new Linux kernel rootkit called ShadowGuard, believed to be unique to this particular nation-state group. It’s a stealthy Extended Berkeley Packet Filter (eBPF) backdoor that hides process information, directories, and files at the kernel level, which makes it very difficult to detect.

TGR-STA-1030 also used real-world geopolitical events in its campaigns, including the US government shutdown that began in October 2025 – during which Unit 42 observed the spies scanning government infrastructure across North, Central, and South America.

In another case, the researchers say in August 2025, Czech President Petr Pavel privately met with the Dalai Lama during a trip to India, and in the following weeks, the snoop crew began scanning Czech infrastructure across the army, police, parliament, and ministries of interior, finance, and foreign affairs.

Additionally, soon after January 3, when an American military operation captured Venezuelan President Nicolás Maduro and his wife, the snoops conducted “extensive reconnaissance activities targeting at least 140 government-owned IP addresses,” according to Unit 42. 

This new nation-state group “remains an active threat to government and critical infrastructure worldwide,” the researchers said. ®

Spain’s Ministry of Science (Ministerio de Ciencia) announced a partial shutdown of its IT systems, affecting several citizen- and company-facing services.

Ministerio de Ciencia, Innovación y Universidades is the Spanish government body responsible for science policy, research, innovation, and higher education.

Among others, it maintains administrative systems used by researchers, universities, and students that handle high-value, sensitive information.

The Ministry stated that the decision was in reaction to a “technical incident,” but did not provide additional details. However, a threat actor is claiming an attack on the institution’s systems and published data samples as proof of the breach.

“As a result of a technical incident currently under assessment, the electronic headquarters of the Ministry of Science, Innovation and Universities has been partially closed,” reads an announcement on the main page of the ministry’s website.

“All ongoing administrative procedures are suspended, while safeguarding the rights and legitimate interests of all persons affected by this temporary closure.”

To mitigate the impact of the disruption, the Ministry will extend all deadlines for affected procedures, in accordance with Article 32 of Law 39/2015.

A threat actor using the alias ‘GordonFreeman’ from the Half-Life game title offered to the highest bidder data allegedly stolen from the Spanish ministry.

The alleged hacker leaked on underground forums data samples that include personal records, email addresses, enrollment applications, and screenshots of documents and other official paperwork.

The threat actor states that they breached Spain’s Ministry of Science by exploiting a critical Insecure Direct Object Reference (IDOR) vulnerability that gave them valid credentials for “full- admin-level access.”

It’s worth noting that the forum where the information appeared is now offline, and the data has not appeared on alternative platforms yet.

The leaked images appear legitimate, although BleepingComputer has no way to confirm their authenticity or any of the attacker’s other claims. We have contacted Ministerio de Ciencia about these allegations, but a statement wasn’t immediately available.

Meanwhile, Spanish media outlets report that a ministry spokesperson confirmed that the IT systems disruption is related to a cyberattack.

Modern IT infrastructure moves faster than manual workflows can handle.

In this new Tines guide, learn how your team can reduce hidden manual delays, improve reliability through automated response, and build and scale intelligent workflows on top of tools you already use.

Get the guide

If you work in security operations, the concept of the AI SOC agent is likely familiar. Early narratives promised total autonomy. Vendors seized on the idea of the “Autonomous SOC” and suggested a future where algorithms replaced analysts.

That future has not arrived. We have not seen mass layoffs or empty security operations centers. We have instead seen the emergence of a practical reality. The deployment of AI in the SOC has not removed the human element. It has instead redefined how they are spending their time. 

We now understand that the value of AI is not in replacing the operator. It is in solving the math problem of defense. Infrastructure complexity scales exponentially while headcount scales linearly. This mismatch previously forced teams to make statistical compromises and sample alerts rather than solving them. Agentic AI corrects this imbalance. It decouples investigation capacity from human availability and fundamentally alters the daily workflow of the security operations team.

Redefining Triage and Investigation: Automated Context at Scale

Alert triage currently functions as a filter. SOC analysts review basic telemetry to decide if an alert warrants a full investigation. This manual gatekeeping creates a bottleneck where low-fidelity signals are ignored to preserve bandwidth. Now imagine if an alert that comes in as low severity and is pushed down the priority queue ends up being a real threat. This is where missed alerts lead to breaches. 

Agentic AI changes triage by adding a machine layer that investigates every alert, regardless of severity, with human-level accuracy before it reaches the analyst. It pulls disjointed telemetry from EDR, identity, email, cloud, SaaS, and network tools into a unified context. The system performs the initial analysis and correlation and redetermines the severity, instantly pushing that low-severity alert to the top. This enables the analyst to concentrate on detecting malicious actors concealed within the noise.

The human operator no longer spends time gathering IP reputation or verifying user locations. Their role shifts to reviewing the verdict provided by the system. This ensures that 100% of alerts receive a full investigation as soon as they arrive. Zero dwell time for every alert. The forced tradeoff of ignoring low-fidelity signals disappears because the cost of investigation is significantly lower with AI SOC agents. 

Impact on Detection Engineering: Visualizing the Noise

Effective detection engineering requires feedback loops that manual SOCs struggle to provide. Analysts often close false positives without detailed documentation, which leaves detection engineers blind to which rules generate the most operational waste.

An AI-driven architecture creates a structured feedback loop for detection logic. Because the system investigates every alert, it aggregates data on which rules consistently produce false positives. It identifies specific detection logic that requires tuning and provides the evidence needed to modify it.

This visibility allows engineers to surgically prune noisy alerts. They can retire or adjust low-value rules based on empirical data rather than anecdotal complaints. The SOC becomes cleaner over time as the AI highlights exactly where the noise lives.

AI removes this syntax barrier. It enables natural language interaction with security data. An analyst can ask semantic questions about the environment. A query such as “show me all lateral movement attempts from unmanaged devices in the last 24 hours” translates instantly into the necessary database queries.

This capability democratizes threat hunting. Senior analysts can execute complex hypotheses faster. Junior analysts can participate in hunting operations without needing years of query language experience. The focus remains on the investigative theory rather than the mechanics of data retrieval.

Why Organizations Choose Prophet Security

What we’ve found from Prophet Security customers is that successful deployment of Agentic AI in a live environment hinges on several critical standards: Depth, Accuracy, Transparency, Adaptability, and Workflow Integration. These are the foundational pillars essential for human operators to trust the AI system’s judgment and operationalize it. Without excelling in these areas, AI adoption will falter, as the human team will lack confidence in its verdicts.

Depth requires the system to replicate the cognitive workflow of a Tier 1-3 analyst. Basic automation checks a file hash and stops. Agentic AI must go further. It must pivot across identity providers, EDR, and network logs to build a complete picture. It must understand the nuance of internal business logic to investigate with the same breadth and rigor as a human expert.

Accuracy is the measure of utility. The system must reliably distinguish between benign administrative tasks and genuine threats. High fidelity ensures that analysts can rely on the system’s verdicts without constant re-verification. Not surprisingly, depth of investigation and accuracy go hand-in-hand. Prophet Security’s accuracy is consistently above 98%, including where it counts the most: identifying true positives.

Transparency and explainability are the ultimate test of trust. AI builds trust by providing transparency into its operations, detailing the queries run against data sources, the specific data retrieved, and the logical conclusions drawn. Prophet Security enforces a “Glass Box” standard that meticulously documents and exposes every query, data point, and logic step used to determine whether the alert is a true positive or benign.

Adaptability refers to how well the AI system ingests feedback and guidance, and other organizational-specific context to improve its accuracy. The AI system should effectively mold around your environment and its unique security needs and risk tolerance. Prophet Security has built a Guidance system that enables a human-on-the-loop model where analysts provide feedback and organizational context to customize the AI’s investigation and response logic to their needs. 

Workflow Integration is crucial. Tools must not only integrate with your existing technology stack but also seamlessly fit into your current security operations workflows. A solution that demands a complete overhaul of existing systems or clashes with your established security tool implementation will be unusable from the start. Prophet Security understands this necessity, as the platform was developed by former SOC analysts from leading firms like Mandiant, Red Canary, and Expel. We’ve prioritized integration quality to ensure a seamless experience and immediate value for every security team.

To learn more about Prophet Security and see why teams trust Prophet AI to triage, investigate, and respond to all of their alerts, request a demo today.