Shadow-Earth-054

SHADOW-EARTH-054 is a China-aligned intrusion cluster associated with cyberespionage activity targeting many of the same organizations affected by SHADOW-EARTH-053. The cluster has been observed compromising government, defense-adjacent, critical infrastructure, transportation, and technology-related organizations, primarily across South, Southeast, and East Asia, with overlap also extending to Poland. It is notable for repeated victim overlap with SHADOW-EARTH-053, shared exploitation of exposed Microsoft Exchange and IIS systems, identical tool hashes for some utilities, and closely overlapping tradecraft. Available reporting assesses this overlap as consistent with parallel exploitation of the same strategic target sets and exposed environments rather than confirmed direct operational coordination. Observed SHADOW-EARTH-054 activity frequently preceded later ShadowPad deployment attributed to SHADOW-EARTH-053 by months, indicating an earlier access-and-positioning role in some environments. The cluster used the same initial access paths seen in related activity, including exploitation of vulnerable internet-facing Exchange and IIS servers, followed by deployment of web shells for persistence and remote command execution. Reporting also attributes a malicious loader family to SHADOW-EARTH-054 in several recent cases. Shared tooling and overlaps connect SHADOW-EARTH-054 with activity tracked by other vendors as CL-STA-0049, REF7707, and Earth Alux. The cluster is assessed as aligned with Chinese intelligence priorities and primarily motivated by espionage. Its victimology and operational patterns indicate sustained collection against state, defense, and strategically relevant regional targets.