Shadow Campaigns Diaoyu Loader Process

Daniel Jeremiah@daniyyell

•updated Feb 20, 2026•1•0•24

This rule detects the execution of processes with command lines containing specific strings associated with the Diaoyu loader, a component of the Shadow Campaigns espionage activity. The rule looks for the presence of 'pic1.png', 'padeqav', 'admin-bar-sprite', or 'DiaoYu' within the command line arguments of newly created processes. This activity is linked to Unit 42 TGR-STA-1030.