Brandon Jeup

🔥 Palo Alto Networks opted not to tie China to a global cyberespionage campaign the firm exposed last week over concerns that the cybersecurity company or its clients could face retaliation from Beijing. Palo Alto’s findings that China was tied to the sprawling hacking spree were dialed back following last month’s news that Palo Alto was one of about 15 US and Israeli cybersecurity companies whose software had been banned by 🇨🇳 authorities on national security grounds. A draft version of the report by Palo Alto’s threat intelligence arm Unit 42 said that the prolific hackers — dubbed “TGR-STA-1030” in a report published on Feb 5 — were connected to Beijing. The finished report instead described the hacking group more vaguely as a “state-aligned group that operates out of Asia.” Attributing sophisticated hacks is notoriously difficult and debates over how best to assign blame for digital intrusions are common among cybersecurity researchers. But Palo Alto has attributed hacks to China in the past, including as recently as this past Sep, and Unit 42’s researchers were confident, based on a wealth of forensic clues, that the newly uncovered hacking campaign was tied to China too. The change was ordered by Palo Alto executives because they were concerned by the software ban and feared drawing retaliation from 🇨🇳 authorities, either against the company’s personnel in China or its clients elsewhere. It’s unclear which executives made the decision to soften the report’s conclusions. Asked to comment on the allegedly softened language, Palo Alto issued a statement that said in part: “Attribution is irrelevant.” Palo Alto's vice president of global communications, Nicole Hockin, said in subsequent emails that the statement was meant to communicate that the lack of attribution in Palo Alto's report was not correlated with "procurement regulations in China" and that any suggestion otherwise was "speculative and false." She said the choice of language in Palo Alto's report reflected "how to best inform and protect governments about this widespread campaign." ‘THE SHADOW CAMPAIGNS’ Palo Alto first detected the hacking group TGR-STA-1030 in early 2025, according to the report. In a wide-ranging effort that Palo Alto dubbed “The Shadow Campaigns,” the spies allegedly conducted reconnaissance against nearly every country in the world and successfully broke into government and critical infrastructure organizations in 37 countries. Although China was not mentioned by name, close readers of Palo Alto’s report might still come away with the impression that Beijing was involved. For example, the researchers noted that the hackers’ activity aligned with the GMT+8 time zone, which includes China, and that the hackers appeared to focus on Czechia’s government infrastructure following an Aug meeting between Czechia’s president and the Dalai Lama. The report also noted that the hackers targeted Thailand on Nov 5 ahead of a diplomatic “visit.” The details of the trip were not provided in the report, but the following week marked a reigning Thai king’s first state visit to Beijing. Palo Alto has five offices in China, including locations in Beijing, Shanghai and Guangzhou. LinkedIn lists more than 70 self-identified Palo Alto employees across China, including engineers and account managers. The incident illustrates the trade-offs cybersecurity companies — especially ones with global footprints — often face when they consider whether to call out state-sponsored cyberespionage campaigns. On the one hand, exposing foreign spies can draw industry plaudits and positive publicity. On the other hand, tangling with a foreign intelligence service can trigger reprisals. “People have always taken risks by naming names. It was always unpleasant and if you have people on the ground, like large companies do, that’s an additional consideration. Are you putting your own people — your local staff — at risk?” reuters.com/world/china/palo… unit42.paloaltonetworks.com/…