Shadow-Earth-053

SHADOW-EARTH-053 is a China-aligned cyberespionage cluster active since at least December 2024. The group has targeted government agencies, defense ministries, defense-adjacent contractors, critical infrastructure organizations, technology firms, transportation entities, and at least one defense-sector organization in Europe. Victimology is concentrated in South, East, and Southeast Asia, with confirmed targeting in Pakistan, Thailand, Malaysia, India, Myanmar, Sri Lanka, Taiwan, and Poland. Reporting also notes overlap in victims, tooling, and tradecraft with the related cluster SHADOW-EARTH-054, although available evidence indicates parallel exploitation of similar opportunities rather than confirmed direct operational coordination. The group primarily gains initial access by exploiting unpatched, internet-facing Microsoft Exchange Server and IIS systems, especially the ProxyLogon vulnerability chain. After compromise, it establishes persistence with web shells including GODZILLA and additional ASPX or ASHX handlers, then deploys ShadowPad as a principal post-compromise backdoor. ShadowPad delivery has relied on DLL sideloading with legitimate signed executables, including renamed binaries, and registry-staged encrypted payloads that are decrypted and executed on the victim host. Observed persistence mechanisms also include scheduled tasks configured for repeated elevated execution. Post-exploitation activity includes extensive reconnaissance of Active Directory and Exchange environments, mailbox discovery and export through Exchange Web Services, credential theft from LSASS and other sources, and lateral movement across internal Exchange and Windows infrastructure. Operators have used WMIC, Sharp-SMBExec, custom host-enumeration tooling, and administrative shares to expand access. They have also deployed multiple tunneling and proxy tools to maintain covert communications and operational redundancy. Defense evasion has included renamed legitimate binaries, packing of malicious binaries, registry-resident payload staging, and process execution through IIS worker processes. The campaign is assessed as primarily espionage-driven and aligned with Chinese strategic intelligence priorities. In addition to traditional state-focused collection against ministries, defense-linked entities, and critical infrastructure, associated reporting ties the broader activity to surveillance of journalists and diaspora activists through related phishing clusters known as Glitter Carp and Sequin Carp. High-confidence reporting on SHADOW-EARTH-053 itself supports characterization as a China-aligned intrusion set focused on long-term access, intelligence collection, and theft of sensitive governmental, defense, and organizational information.