TGR-STA-1030 — APT Profile
TGR-STA-1030, also tracked as UNC6619, is a state-aligned cyberespionage cluster that Palo Alto Networks Unit 42 first reported in February 2026 under the campaign name Shadow Campaigns. TGR-STA is Unit 42's own placeholder prefix, denoting a temporary group of state-aligned activity while attribution to a specific organisation is still being refined, so this is not a settled identity. Unit 42 assesses with high confidence that the group operates out of Asia but has not attributed it to any specific country, which is why its origin is carried here as Unknown rather than inferred from tooling or timezone patterns. Unit 42 attributes to it the compromise of at least 70 organisations across 37 countries in the preceding year, including government and critical-infrastructure entities in Ethiopia, and reconnaissance against government infrastructure associated with 155 countries between November and December 2025. Actor infrastructure dates back to at least January 2024.Also tracked as
UNC6619