<![CDATA[RaidForums - World News]]> https://raidforums.im/ Sat, 29 Aug 2026 08:37:25 +0000 MyBB <![CDATA[Ansar Allah’s Cyberattack on French Infrastructure]]> https://raidforums.im/Thread-Ansar-Allah%E2%80%99s-Cyberattack-on-French-Infrastructure Tue, 25 Aug 2026 09:35:54 +0000 UWAYS]]> https://raidforums.im/Thread-Ansar-Allah%E2%80%99s-Cyberattack-on-French-Infrastructure Yemen’s Uways al-Qarani in the Heart of France: Ansar Allah’s Cyberattack on French Infrastructure

In the name of God, the Avenger, the Compeller.

The Cyber Defense Organization of Yemen’s Ansar Allah and the Uways al-Qarani hacker group, relying on divine favor and the support of the steadfast people, carried out a successful operation against the French company K-and-Decide. This action was a direct and explicit response to statements made by French officials against Ansar Allah and the Yemeni people.

During this operation, a significant portion of France’s cyber infrastructure was targeted, and nine terabytes of data were completely deleted. We now possess full details of the software and hardware used within France’s critical infrastructure. Some of the disruptions and paralysis affecting France’s digital systems in recent days are a direct result of cyberattacks conducted by the Ansar Allah Cyber Defense Organization and the Uways al-Qarani group.

We warn the French government: your open support for the Zionist lobby, Zionist racism in your country, and your role in supporting the killing of children in Gaza, Lebanon, and Yemen—under the pretext of defending Lebanon—are nothing but a continuation of colonialism and modern slavery. Through your policies, you have held the livelihood and future of Yemeni children hostage to your sinister policies and unjust sanctions, while submitting to modern Epsteinian and Zionist servitude.

Our advice to you is this: free yourselves from the chains of the Zionist and Epsteinian lobbies. If you are unable to free yourselves, we are prepared to liberate the French people from Western-Zionist captivity.

This is only the beginning of a new chapter in cyber warfare. Resistance against oppression and conspiracy will continue until the final breath.

May peace, mercy, and blessings of God be upon you.

https://t.me/UWAYS_QARANI

https://t.me/UWAYS_QARANI

[Image: kd1.png]

[Image: kd2.png]

[Image: kd3.png]

[Image: kd4.png]

[Image: kd5.png]

[Image: kd6.png]

[Image: kd7.png]

[Image: kd8.png]

[Image: kd19.png]]]> Yemen’s Uways al-Qarani in the Heart of France: Ansar Allah’s Cyberattack on French Infrastructure

In the name of God, the Avenger, the Compeller.

The Cyber Defense Organization of Yemen’s Ansar Allah and the Uways al-Qarani hacker group, relying on divine favor and the support of the steadfast people, carried out a successful operation against the French company K-and-Decide. This action was a direct and explicit response to statements made by French officials against Ansar Allah and the Yemeni people.

During this operation, a significant portion of France’s cyber infrastructure was targeted, and nine terabytes of data were completely deleted. We now possess full details of the software and hardware used within France’s critical infrastructure. Some of the disruptions and paralysis affecting France’s digital systems in recent days are a direct result of cyberattacks conducted by the Ansar Allah Cyber Defense Organization and the Uways al-Qarani group.

We warn the French government: your open support for the Zionist lobby, Zionist racism in your country, and your role in supporting the killing of children in Gaza, Lebanon, and Yemen—under the pretext of defending Lebanon—are nothing but a continuation of colonialism and modern slavery. Through your policies, you have held the livelihood and future of Yemeni children hostage to your sinister policies and unjust sanctions, while submitting to modern Epsteinian and Zionist servitude.

Our advice to you is this: free yourselves from the chains of the Zionist and Epsteinian lobbies. If you are unable to free yourselves, we are prepared to liberate the French people from Western-Zionist captivity.

This is only the beginning of a new chapter in cyber warfare. Resistance against oppression and conspiracy will continue until the final breath.

May peace, mercy, and blessings of God be upon you.

https://t.me/UWAYS_QARANI

https://t.me/UWAYS_QARANI

[Image: kd1.png]

[Image: kd2.png]

[Image: kd3.png]

[Image: kd4.png]

[Image: kd5.png]

[Image: kd6.png]

[Image: kd7.png]

[Image: kd8.png]

[Image: kd19.png]]]> <![CDATA[DDOS attack on India]]> https://raidforums.im/Thread-DDOS-attack-on-India Mon, 24 Aug 2026 20:24:36 +0000 User85957388990]]> https://raidforums.im/Thread-DDOS-attack-on-India [Image: Gemini-Generated-Image-2veh6r2veh6r2veh.jpg]

channel: https://t.me/hackedrobot

Quote:We are Anonymous. We are Legion. We do not forgive. We do not forget. Expect us. we know indians want to report our channel to get it blocked. but we can move underground, and Expect us
site: https://starair.in/
check: https://check-host.net/check-report/48a98903k84
site: https://railtc.in/
check: https://check-host.net/check-report/48aa6f4ckdde
site: https://icmai.in
check: https://check-host.net/check-report/48aa9972kd2
]]> [Image: Gemini-Generated-Image-2veh6r2veh6r2veh.jpg]

channel: https://t.me/hackedrobot

Quote:We are Anonymous. We are Legion. We do not forgive. We do not forget. Expect us. we know indians want to report our channel to get it blocked. but we can move underground, and Expect us
site: https://starair.in/
check: https://check-host.net/check-report/48a98903k84
site: https://railtc.in/
check: https://check-host.net/check-report/48aa6f4ckdde
site: https://icmai.in
check: https://check-host.net/check-report/48aa9972kd2
]]> <![CDATA[Yemeni Cyberattack on the Israeli Regime’s Power Grid]]> https://raidforums.im/Thread-Yemeni-Cyberattack-on-the-Israeli-Regime%E2%80%99s-Power-Grid Sun, 23 Aug 2026 06:29:54 +0000 UWAYS]]> https://raidforums.im/Thread-Yemeni-Cyberattack-on-the-Israeli-Regime%E2%80%99s-Power-Grid Yemeni Cyberattack on the Israeli Regime’s Power Grid: The Uwais al-Qarani Hacker Group Took Several Power Stations Offline

In the name of God, the Crusher of Tyrants.

Once again, the capable hands of Yemen’s cyber fighters caught the aggressor enemy by surprise. Relying on the faith of the resilient nation and its revolutionary spirit, Ansar Allah’s Cyber Defense Organization—through the cyber fighters of the Uwais al-Qarani hacker group—carried out a remarkable operation against the Israeli regime’s critical infrastructure.

During this operation, the core of the enemy’s industrial electricity-control systems was targeted with precision and expertise. One of its largest solar farms, consisting of more than 5,000 panels near Tel Aviv, was suddenly shut down and taken offline. This incident dealt a severe blow to the occupiers’ security claims and technological pride. It also sent a clear message that Yemen is now prepared to respond to any aggression—on the ground, in the shadows, and in cyberspace.

With pride and affection, we dedicate this operation to the Handala Popular Resistance Front, whose courage and steadfastness have inspired—and will continue to inspire—a new generation of Yemeni cyber fighters.

Our message to the enemy is clear: your days of comfort are over. Your infrastructure is within our reach, and every act of aggression will be met with a heavier and more devastating response. From now on, the shadow of defeat and fear will follow you.

Until our final breath, guided by God’s promise and the determination of the Yemeni people, the banner of our resistance will always remain raised. The future belongs to Yemen, the resistance, and the free people of the world.

Peace, mercy, and blessings of God be upon you.

SITE: WWW.UWAYS.TO

TELEGRAM: https://t.me/UWAYS_QARANI

#DOWN_ISRAEL #DOWN_US #DOWN_KSA

[Image: elil19.png]

[Image: elil18.png]

[Image: elil16.png]

[Image: elil16.png]

[Image: elil5.png]

[Image: elil12.png]

[Image: elil2.png]

[Image: elil13.png]]]> Yemeni Cyberattack on the Israeli Regime’s Power Grid: The Uwais al-Qarani Hacker Group Took Several Power Stations Offline

In the name of God, the Crusher of Tyrants.

Once again, the capable hands of Yemen’s cyber fighters caught the aggressor enemy by surprise. Relying on the faith of the resilient nation and its revolutionary spirit, Ansar Allah’s Cyber Defense Organization—through the cyber fighters of the Uwais al-Qarani hacker group—carried out a remarkable operation against the Israeli regime’s critical infrastructure.

During this operation, the core of the enemy’s industrial electricity-control systems was targeted with precision and expertise. One of its largest solar farms, consisting of more than 5,000 panels near Tel Aviv, was suddenly shut down and taken offline. This incident dealt a severe blow to the occupiers’ security claims and technological pride. It also sent a clear message that Yemen is now prepared to respond to any aggression—on the ground, in the shadows, and in cyberspace.

With pride and affection, we dedicate this operation to the Handala Popular Resistance Front, whose courage and steadfastness have inspired—and will continue to inspire—a new generation of Yemeni cyber fighters.

Our message to the enemy is clear: your days of comfort are over. Your infrastructure is within our reach, and every act of aggression will be met with a heavier and more devastating response. From now on, the shadow of defeat and fear will follow you.

Until our final breath, guided by God’s promise and the determination of the Yemeni people, the banner of our resistance will always remain raised. The future belongs to Yemen, the resistance, and the free people of the world.

Peace, mercy, and blessings of God be upon you.

SITE: WWW.UWAYS.TO

TELEGRAM: https://t.me/UWAYS_QARANI

#DOWN_ISRAEL #DOWN_US #DOWN_KSA

[Image: elil19.png]

[Image: elil18.png]

[Image: elil16.png]

[Image: elil16.png]

[Image: elil5.png]

[Image: elil12.png]

[Image: elil2.png]

[Image: elil13.png]]]> <![CDATA[New Ebola outbreak reported.]]> https://raidforums.im/Thread-New-Ebola-outbreak-reported Fri, 21 Aug 2026 19:44:29 +0000 tobmiaexe]]> https://raidforums.im/Thread-New-Ebola-outbreak-reported How do you think this situation will develop over the coming weeks? Do you believe current containment measures will hold, or are we looking at a wider regional spread? Share your thoughts below.]]> How do you think this situation will develop over the coming weeks? Do you believe current containment measures will hold, or are we looking at a wider regional spread? Share your thoughts below.]]> <![CDATA[Psycho-physical impacts in war and conflicts.]]> https://raidforums.im/Thread-Psycho-physical-impacts-in-war-and-conflicts Sat, 28 Mar 2026 14:12:58 +0000 36mn]]> https://raidforums.im/Thread-Psycho-physical-impacts-in-war-and-conflicts
https://casebook.icrc.org/a_to_z/glossary/self-defence
https://www.sciencedirect.com/science/ar...9725000454]]>
https://casebook.icrc.org/a_to_z/glossary/self-defence
https://www.sciencedirect.com/science/ar...9725000454]]> <![CDATA[Dear Governments of the World , you should read this .]]> https://raidforums.im/Thread-Dear-Governments-of-the-World-you-should-read-this Sat, 28 Mar 2026 12:29:48 +0000 zelda]]> https://raidforums.im/Thread-Dear-Governments-of-the-World-you-should-read-this To the Five Kingdoms
To the Sykes–Picot States
We are Zelda
This is our red line, Do not test our patience.
If you participate in the war against the (Axis of Right), our response will not be military alone, we will strike from where you do not expect.
We will expose to the world your biological facilities and your most sensitive data.
We will not start the war, but we will be the ones to end it.
To anyone considering joining or supporting the old Sam you have one choice, Either you stand with what is right, or you face the consequences.
There is no neutrality here.
Whoever stands with them becomes a target for us, with no exceptions.
We speak for the people, people speaks for us.


К Пяти Королевствам
К государствам Сайкса—Пико
Мы — Зельда
Это наша красная линия. Не испытывайте наше терпение. Если вы примете участие в войне против (Оси Справедливости), наш ответ не будет только военным — мы ударим оттуда, откуда вы не ждете. Мы раскроем миру ваши биологические объекты и ваши самые чувствительные данные.
Мы не начнем войну, но мы будем теми, кто ее закончит.
Каждому, кто думает присоединиться или поддержать Старика Сэма: перед вами один выбор. Либо вы на стороне справедливости, либо вы несете последствия. Никакого нейтралитета здесь нет. Тот, кто встанет с ними, становится для нас целью — без исключений.
Мы говорим от имени народа, а народ говорит от нашего имени.


إلى دول الممالك الخمس
إلى دول سايكس بيكو
نحن زيلدا
هذا هو خطنا الأحمر. لا تختبروا صبرنا. إذا أقدمتم على الاشتراك في الحرب ضد (محور الحق)، فلن يكون ردنا عسكرياً فقط… بل سنضرب من حيث لا تتوقعون. سنكشف للعالم منشآتكم الحيوية وبياناتكم الأكثر حساسية.
لن نبدأ الحرب، لكننا من سينهيها.
إلى كل من يفكر بالانضمام أو مساندة العجوز سام: أنتم أمام خيار واحد. إما أن تكونوا مع الحق، أو أن تتحملوا العواقب. لا حياد هنا. من يقف معهم يصبح هدفاً لنا بلا استثناء
نحن نتحدث باسم الشعب، والشعب يتحدث باسمنا

We'll publish a highly sensitive Documents Starting with The Kingdom of Saudi Government if those people keep supporting the Satan

 15,076 Files   -   12.1 GB (13,022,035,968 bytes)   of Arabian gulf highly sensitive documents 
If breachforums stayed a live , and back like before ,  we shall  release the voice call between Saudi officials admitting of taking a  bribe in 2023 - 2024  from their own citizens  
 
Samples of Targets industries

[Image: 1.jpg]
[Image: 2.jpg]
[Image: 3.jpg]
[Image: 4.jpg]
[Image: 5.png]
[Image: 6.png]
[Image: 7.png]
[Image: a1.jpg]
[Image: a2.jpg]
[Image: cars.jpg]
[Image: x1.png]
]]> To the Five Kingdoms
To the Sykes–Picot States
We are Zelda
This is our red line, Do not test our patience.
If you participate in the war against the (Axis of Right), our response will not be military alone, we will strike from where you do not expect.
We will expose to the world your biological facilities and your most sensitive data.
We will not start the war, but we will be the ones to end it.
To anyone considering joining or supporting the old Sam you have one choice, Either you stand with what is right, or you face the consequences.
There is no neutrality here.
Whoever stands with them becomes a target for us, with no exceptions.
We speak for the people, people speaks for us.


К Пяти Королевствам
К государствам Сайкса—Пико
Мы — Зельда
Это наша красная линия. Не испытывайте наше терпение. Если вы примете участие в войне против (Оси Справедливости), наш ответ не будет только военным — мы ударим оттуда, откуда вы не ждете. Мы раскроем миру ваши биологические объекты и ваши самые чувствительные данные.
Мы не начнем войну, но мы будем теми, кто ее закончит.
Каждому, кто думает присоединиться или поддержать Старика Сэма: перед вами один выбор. Либо вы на стороне справедливости, либо вы несете последствия. Никакого нейтралитета здесь нет. Тот, кто встанет с ними, становится для нас целью — без исключений.
Мы говорим от имени народа, а народ говорит от нашего имени.


إلى دول الممالك الخمس
إلى دول سايكس بيكو
نحن زيلدا
هذا هو خطنا الأحمر. لا تختبروا صبرنا. إذا أقدمتم على الاشتراك في الحرب ضد (محور الحق)، فلن يكون ردنا عسكرياً فقط… بل سنضرب من حيث لا تتوقعون. سنكشف للعالم منشآتكم الحيوية وبياناتكم الأكثر حساسية.
لن نبدأ الحرب، لكننا من سينهيها.
إلى كل من يفكر بالانضمام أو مساندة العجوز سام: أنتم أمام خيار واحد. إما أن تكونوا مع الحق، أو أن تتحملوا العواقب. لا حياد هنا. من يقف معهم يصبح هدفاً لنا بلا استثناء
نحن نتحدث باسم الشعب، والشعب يتحدث باسمنا

We'll publish a highly sensitive Documents Starting with The Kingdom of Saudi Government if those people keep supporting the Satan

 15,076 Files   -   12.1 GB (13,022,035,968 bytes)   of Arabian gulf highly sensitive documents 
If breachforums stayed a live , and back like before ,  we shall  release the voice call between Saudi officials admitting of taking a  bribe in 2023 - 2024  from their own citizens  
 
Samples of Targets industries

[Image: 1.jpg]
[Image: 2.jpg]
[Image: 3.jpg]
[Image: 4.jpg]
[Image: 5.png]
[Image: 6.png]
[Image: 7.png]
[Image: a1.jpg]
[Image: a2.jpg]
[Image: cars.jpg]
[Image: x1.png]
]]> <![CDATA[Iran report news.]]> https://raidforums.im/Thread-Iran-report-news Sat, 28 Mar 2026 10:29:12 +0000 36mn]]> https://raidforums.im/Thread-Iran-report-news
https://understandingwar.org/research/mi...h-25-2026/]]>
https://understandingwar.org/research/mi...h-25-2026/]]> <![CDATA[News about META, Updated March 17, 2026.]]> https://raidforums.im/Thread-News-about-META-Updated-March-17-2026 Fri, 27 Mar 2026 13:51:19 +0000 36mn]]> https://raidforums.im/Thread-News-about-META-Updated-March-17-2026
https://www.reuters.com/business/world-a...026-03-14/]]>
https://www.reuters.com/business/world-a...026-03-14/]]> <![CDATA[About the forums news?]]> https://raidforums.im/Thread-About-the-forums-news Fri, 27 Mar 2026 13:38:50 +0000 36mn]]> https://raidforums.im/Thread-About-the-forums-news <![CDATA[agi in 2027?]]> https://raidforums.im/Thread-agi-in-2027 Tue, 10 Feb 2026 18:43:34 +0000 datasus]]> https://raidforums.im/Thread-agi-in-2027 AI 2027]]> AI 2027]]> <![CDATA[State actor targets 155 countries in 'Shadow Campaigns' espionage op]]> https://raidforums.im/Thread-State-actor-targets-155-countries-in-Shadow-Campaigns-espionage-op Tue, 10 Feb 2026 16:51:25 +0000 Shadowraser]]> https://raidforums.im/Thread-State-actor-targets-155-countries-in-Shadow-Campaigns-espionage-op State actor targets 155 countries in 'Shadow Campaigns' espionage op
 
By Bill Toulas
 
A state-sponsored threat group has compromised dozens of networks of government and critical infrastructure entities in 37 countries in global-scale operations dubbed 'Shadow Campaigns'.
 
Between November and December last year, the actor also engaged in reconnaissance activity targeting government entities connected to 155 countries.
 
According to Palo Alto Networks’ Unit 42 division, the group has been active since at least January 2024, and there is high confidence that it operates from Asia. Until definitive attribution is possible, the researchers track the actor as TGR-STA-1030/UNC6619.
 
'Shadow Campaigns' activity focuses primarily on government ministries, law enforcement, border control, finance, trade, energy, mining, immigration, and diplomatic agencies.
 
Unit 42 researchers confirmed that the attacks successfully compromised at least 70 government and critical infrastructure organizations across 37 countries.
 
This includes organizations engaged in trade policy, geopolitical issues, and elections in the Americas; ministries and parliaments across multiple European states; the Treasury Department in Australia; and government and critical infrastructure in Taiwan.
 
[Image: F1.jpg]
Targeted countries (top) and confirmed compromises (bottom)
Source: Unit 42
 
The list of countries with targeted or compromised organizations is extensive and focused on certain regions with particular timing that appears to have been driven by specific events.
 
The researchers say that during the U.S. government shutdown in October 2025, the threat actor showed increased interest in scanning entities across North, Central and South America (Brazil, Canada, Dominican Republic, Guatemala, Honduras, Jamaica, Mexico, Panama, and Trinidad and Tobago).
 
Significant reconnaissance activity was discovered against "at least 200 IP addresses hosting Government of Honduras infrastructure" just 30 days before the national election, as both candidates indicated willingness to restore diplomatic ties with Taiwan.
  
Unit 42 assesses that the threat group compromised the following entities:
 
  •     Brazil’s Ministry of Mines and Energy
  •     the network of a Bolivian entity associated with mining
  •     two of Mexico’s ministries
  •     a government infrastructure in Panama
  •     an IP address that geolocates to a Venezolana de Industria Tecnológica facility
  •     compromised government entities in Cyprus, Czechia, Germany, Greece, Italy, Poland, Portugal, and Serbia
  •     an Indonesian airline
  •     multiple Malaysian government departments and ministries
  •     a Mongolian law enforcement entity
  •     a major supplier in Taiwan's power equipment industry
  •     a Thai government department (likely for economic and international trade information)
  •     critical infrastructure entities in the Democratic Republic of the Congo, Djibouti, Ethiopia, Namibia, Niger, Nigeria, and Zambia
     
Unit 42 also believes that TGR-STA-1030/UNC6619 also tried to connect over SSH to infrastructure associated with Australia’s Treasury Department, Afghanistan’s Ministry of Finance, and Nepal’s Office of the Prime Minister and Council of Ministers.
 
Apart from these compromises, the researchers found evidence indicating reconnaissance activity and breach attempts targeting organizations in other countries.
 
They say that the actor scanned infrastructure connected to the Czech government (Army, Police, Parliament, Ministries of Interior, Finance, Foreign Affairs, and the president's website).
 
The threat group also tried to connect to the European Union infrastructure by targeting more than 600 IP hosting *.europa.eu domains. In July 2025, the group focused on Germany and initiated connections to more than 490 IP addresses that hosted government systems.
 
Shadow Campaigns attack chain
 
Early operations relied on highly tailored phishing emails sent to government officials, with lures commonly referencing internal ministry reorganization efforts.
 
The emails embedded links to malicious archives with localized naming hosted on the Mega.nz storage service. The compressed files contained a malware loader called Diaoyu and a zero-byte PNG file named pic1.png.
 
[Image: phish.jpg]
Sample of the phishing email used in Shadow Campaigns operations
Source: Unit 42
 
Unit 42 researcher found that the Diaoyu loader would fetch Cobalt Strike payloads and the VShell framework for command-and-control (C2) under certain conditions that equate to analysis evasion checks.
 
"Beyond the hardware requirement of a horizontal screen resolution greater than or equal to 1440, the sample performs an environmental dependency check for a specific file (pic1.png) in its execution directory," the researchers say.
 
They explain that the zero-byte image acts as a file-based integrity check. In its absence, the malware terminates before inspecting the compromised host.
 
To evade detection, the loader looks for running processes from the following security products: Kaspersky, Avira, Bitdefender, Sentinel One, and Norton (Symantec).
 
Apart from phishing, TGR-STA-1030/UNC6619 also exploited at least 15 known vulnerabilities to achieve initial access. Unit 42 found that the threat actor leveraged security issues in SAP Solution Manager, Microsoft Exchange Server, D-Link, and Microsoft Windows.
 
New Linux rootkit
 
TGR-STA-1030/UNC6619's toolkit used for Shadow Campaigns activity is extensive and includes webshells such as Behinder, Godzilla, and Neo-reGeorg, as well as network tunneling tools such as GO Simple Tunnel (GOST), Fast Reverse Proxy Server (FRPS), and IOX.
 
However, researchers also discovered a custom Linux kernel eBPF rootkit called ‘ShadowGuard’ that they believe to be unique to the TGR-STA-1030/UNC6619 threat actor.
 
“eBPF backdoors are notoriously difficult to detect because they operate entirely within the highly trusted kernel space,” the researchers explain.
 
“This allows them to manipulate core system functions and audit logs before security tools or system monitoring applications can see the true data.”
 
ShadowGuard conceals malicious process information at the kernel level, hides up to 32 PIDs from standard Linux monitoring tools using syscall interception. It can also hide from manual inspection files and directories named swsecret.
 
Additionally, the malware features a mechanism that lets its operator define processes that should remain visible.
 
The infrastructure used in Shadow Campaigns relies on victim-facing servers with legitimate VPS providers in the U.S., Singapore, and the UK, as well as relay servers for traffic obfuscation, and residential proxies or Tor for proxying.
 
The researchers noticed the use of C2 domains that would appear familiar to the target, such as the use of .gouv top-level extension for French-speaking countries or the dog3rj[.]tech domain in attacks in the European space.
 
"It’s possible that the domain name could be a reference to 'DOGE Jr,' which has several meanings in a Western context, such as the U.S. Department of Government Efficiency or the name of a cryptocurrency," the researchers explain.
 
According to Unit 42, TGR-STA-1030/UNC6619 represents an operationally mature espionage actor who prioritizes strategic, economic, and political intelligence and has already impacted dozens of governments worldwide.
 
Unit 42's report includes indicators of compromise (IoCs) at the bottom of the report to help defenders detect and block these attacks.
]]> State actor targets 155 countries in 'Shadow Campaigns' espionage op
 
By Bill Toulas
 
A state-sponsored threat group has compromised dozens of networks of government and critical infrastructure entities in 37 countries in global-scale operations dubbed 'Shadow Campaigns'.
 
Between November and December last year, the actor also engaged in reconnaissance activity targeting government entities connected to 155 countries.
 
According to Palo Alto Networks’ Unit 42 division, the group has been active since at least January 2024, and there is high confidence that it operates from Asia. Until definitive attribution is possible, the researchers track the actor as TGR-STA-1030/UNC6619.
 
'Shadow Campaigns' activity focuses primarily on government ministries, law enforcement, border control, finance, trade, energy, mining, immigration, and diplomatic agencies.
 
Unit 42 researchers confirmed that the attacks successfully compromised at least 70 government and critical infrastructure organizations across 37 countries.
 
This includes organizations engaged in trade policy, geopolitical issues, and elections in the Americas; ministries and parliaments across multiple European states; the Treasury Department in Australia; and government and critical infrastructure in Taiwan.
 
[Image: F1.jpg]
Targeted countries (top) and confirmed compromises (bottom)
Source: Unit 42
 
The list of countries with targeted or compromised organizations is extensive and focused on certain regions with particular timing that appears to have been driven by specific events.
 
The researchers say that during the U.S. government shutdown in October 2025, the threat actor showed increased interest in scanning entities across North, Central and South America (Brazil, Canada, Dominican Republic, Guatemala, Honduras, Jamaica, Mexico, Panama, and Trinidad and Tobago).
 
Significant reconnaissance activity was discovered against "at least 200 IP addresses hosting Government of Honduras infrastructure" just 30 days before the national election, as both candidates indicated willingness to restore diplomatic ties with Taiwan.
  
Unit 42 assesses that the threat group compromised the following entities:
 
  •     Brazil’s Ministry of Mines and Energy
  •     the network of a Bolivian entity associated with mining
  •     two of Mexico’s ministries
  •     a government infrastructure in Panama
  •     an IP address that geolocates to a Venezolana de Industria Tecnológica facility
  •     compromised government entities in Cyprus, Czechia, Germany, Greece, Italy, Poland, Portugal, and Serbia
  •     an Indonesian airline
  •     multiple Malaysian government departments and ministries
  •     a Mongolian law enforcement entity
  •     a major supplier in Taiwan's power equipment industry
  •     a Thai government department (likely for economic and international trade information)
  •     critical infrastructure entities in the Democratic Republic of the Congo, Djibouti, Ethiopia, Namibia, Niger, Nigeria, and Zambia
     
Unit 42 also believes that TGR-STA-1030/UNC6619 also tried to connect over SSH to infrastructure associated with Australia’s Treasury Department, Afghanistan’s Ministry of Finance, and Nepal’s Office of the Prime Minister and Council of Ministers.
 
Apart from these compromises, the researchers found evidence indicating reconnaissance activity and breach attempts targeting organizations in other countries.
 
They say that the actor scanned infrastructure connected to the Czech government (Army, Police, Parliament, Ministries of Interior, Finance, Foreign Affairs, and the president's website).
 
The threat group also tried to connect to the European Union infrastructure by targeting more than 600 IP hosting *.europa.eu domains. In July 2025, the group focused on Germany and initiated connections to more than 490 IP addresses that hosted government systems.
 
Shadow Campaigns attack chain
 
Early operations relied on highly tailored phishing emails sent to government officials, with lures commonly referencing internal ministry reorganization efforts.
 
The emails embedded links to malicious archives with localized naming hosted on the Mega.nz storage service. The compressed files contained a malware loader called Diaoyu and a zero-byte PNG file named pic1.png.
 
[Image: phish.jpg]
Sample of the phishing email used in Shadow Campaigns operations
Source: Unit 42
 
Unit 42 researcher found that the Diaoyu loader would fetch Cobalt Strike payloads and the VShell framework for command-and-control (C2) under certain conditions that equate to analysis evasion checks.
 
"Beyond the hardware requirement of a horizontal screen resolution greater than or equal to 1440, the sample performs an environmental dependency check for a specific file (pic1.png) in its execution directory," the researchers say.
 
They explain that the zero-byte image acts as a file-based integrity check. In its absence, the malware terminates before inspecting the compromised host.
 
To evade detection, the loader looks for running processes from the following security products: Kaspersky, Avira, Bitdefender, Sentinel One, and Norton (Symantec).
 
Apart from phishing, TGR-STA-1030/UNC6619 also exploited at least 15 known vulnerabilities to achieve initial access. Unit 42 found that the threat actor leveraged security issues in SAP Solution Manager, Microsoft Exchange Server, D-Link, and Microsoft Windows.
 
New Linux rootkit
 
TGR-STA-1030/UNC6619's toolkit used for Shadow Campaigns activity is extensive and includes webshells such as Behinder, Godzilla, and Neo-reGeorg, as well as network tunneling tools such as GO Simple Tunnel (GOST), Fast Reverse Proxy Server (FRPS), and IOX.
 
However, researchers also discovered a custom Linux kernel eBPF rootkit called ‘ShadowGuard’ that they believe to be unique to the TGR-STA-1030/UNC6619 threat actor.
 
“eBPF backdoors are notoriously difficult to detect because they operate entirely within the highly trusted kernel space,” the researchers explain.
 
“This allows them to manipulate core system functions and audit logs before security tools or system monitoring applications can see the true data.”
 
ShadowGuard conceals malicious process information at the kernel level, hides up to 32 PIDs from standard Linux monitoring tools using syscall interception. It can also hide from manual inspection files and directories named swsecret.
 
Additionally, the malware features a mechanism that lets its operator define processes that should remain visible.
 
The infrastructure used in Shadow Campaigns relies on victim-facing servers with legitimate VPS providers in the U.S., Singapore, and the UK, as well as relay servers for traffic obfuscation, and residential proxies or Tor for proxying.
 
The researchers noticed the use of C2 domains that would appear familiar to the target, such as the use of .gouv top-level extension for French-speaking countries or the dog3rj[.]tech domain in attacks in the European space.
 
"It’s possible that the domain name could be a reference to 'DOGE Jr,' which has several meanings in a Western context, such as the U.S. Department of Government Efficiency or the name of a cryptocurrency," the researchers explain.
 
According to Unit 42, TGR-STA-1030/UNC6619 represents an operationally mature espionage actor who prioritizes strategic, economic, and political intelligence and has already impacted dozens of governments worldwide.
 
Unit 42's report includes indicators of compromise (IoCs) at the bottom of the report to help defenders detect and block these attacks.
]]> <![CDATA[Who's next ?]]> https://raidforums.im/Thread-Who-s-next--187488 Tue, 10 Feb 2026 08:49:11 +0000 DC7414]]> https://raidforums.im/Thread-Who-s-next--187488


Chinese President Xi Jinping inspects the Central Military Commission leadership and the Joint Operations Command Center of the Communist Party in November 2022. Six of them, excluding current Vice Chairman Zhang Shengmin, have been purged starting with Li Shangfu in 2023 and recently including Zhang Youxia and Liu Zhenli.
My friend would be very interested if you knew anything.]]>


Chinese President Xi Jinping inspects the Central Military Commission leadership and the Joint Operations Command Center of the Communist Party in November 2022. Six of them, excluding current Vice Chairman Zhang Shengmin, have been purged starting with Li Shangfu in 2023 and recently including Zhang Youxia and Liu Zhenli.
My friend would be very interested if you knew anything.]]> <![CDATA[Who's next ?]]> https://raidforums.im/Thread-Who-s-next--187486 Tue, 10 Feb 2026 08:25:20 +0000 DC7414]]> https://raidforums.im/Thread-Who-s-next--187486


Chinese President Xi Jinping inspects the Central Military Commission leadership and the Joint Operations Command Center of the Communist Party in November 2022. Six of them, excluding current Vice Chairman Zhang Shengmin, have been purged starting with Li Shangfu in 2023 and recently including Zhang Youxia and Liu Zhenli.]]>


Chinese President Xi Jinping inspects the Central Military Commission leadership and the Joint Operations Command Center of the Communist Party in November 2022. Six of them, excluding current Vice Chairman Zhang Shengmin, have been purged starting with Li Shangfu in 2023 and recently including Zhang Youxia and Liu Zhenli.]]> <![CDATA[Chinese Hackers Hijack Notepad++ Updates for 6 Months]]> https://raidforums.im/Thread-Chinese-Hackers-Hijack-Notepad-Updates-for-6-Months Mon, 09 Feb 2026 04:23:29 +0000 miyako]]> https://raidforums.im/Thread-Chinese-Hackers-Hijack-Notepad-Updates-for-6-Months
https://www.darkreading.com/application-...s-6-months]]>
https://www.darkreading.com/application-...s-6-months]]> <![CDATA[US police believe Savannah Guthrie's missing mother is 'still out there']]> https://raidforums.im/Thread-US-police-believe-Savannah-Guthrie-s-missing-mother-is-still-out-there Thu, 05 Feb 2026 22:42:55 +0000 roguebonha]]> https://raidforums.im/Thread-US-police-believe-Savannah-Guthrie-s-missing-mother-is-still-out-there