China-Aligned SHADOW-EARTH-053 Targets Asian Government and Critical Infrastructure
Summary
Trend Micro reports that SHADOW-EARTH-053 has targeted government, critical infrastructure, and related organizations across at least eight countries, exploiting unpatched Exchange and IIS vulnerabilities to deploy web shells and ShadowPad.
Key points
- The campaign dates back to at least December 2024 and targets organizations across South, East, and Southeast Asia, as well as a government target in Poland.
- Attackers exploit internet-facing, unpatched Microsoft Exchange vulnerabilities, including the ProxyLogon CVEs, and install web shells such as GODZILLA for persistent access.
- The group deploys ShadowPad using DLL sideloading and registry-based loaders, and uses tunneling tools including GOST, Wstunnel, and IOX.
- Post-compromise activity includes Active Directory and Exchange reconnaissance, credential theft, lateral movement, and collection of executive email through Exchange.
- Nearly half of SHADOW-EARTH-053’s targets overlapped with SHADOW-EARTH-054; Trend Micro assesses the groups likely exploited the same vulnerabilities independently.
- Trend Micro recommends patching Exchange and IIS, monitoring web directories for suspicious scripts, and detecting unusual processes and outbound connections from IIS servers.
Article Details
- Attack Vectors
- Exploitation of unpatched, internet-facing Microsoft Exchange and IIS vulnerabilities, including the ProxyLogon vulnerabilities, for initial access.
- Installation of GODZILLA web shells on compromised servers for persistent access and command execution.
- ShadowPad deployment through DLL sideloading of legitimate signed executables; in one case, samples were delivered via AnyDesk, though the entry method is uncertain.
- Low-confidence attribution of Linux NOODLERAT samples reportedly dropped through exploitation of CVE-2025-55182 (React2Shell).
- Lateral movement using WMIC, administrative shares, and Pass-the-Hash; attackers also copied web shells to internal Exchange servers.
- Credential collection using Evil-CreateDump, Mimikatz, and a binary named newdcsync, which the researchers assessed was likely used for DCSync.
- Mailbox collection using a custom ExchangeExport tool through the Exchange Web Services API, followed in one case by creation of a password-protected RAR archive containing a PST file.
- Covert communications using GOST and Wstunnel tunnels to a shared external IP address.
- Defensive Notes
- Apply current security updates and cumulative patches to Microsoft Exchange and IIS-hosted web applications; where patching is not immediately feasible, use IPS or WAF rules to block exploit attempts against the cited vulnerabilities.
- Use file integrity monitoring on critical web directories and alert on creation or modification of server-side scripts such as .aspx and .ashx files; inspect for suspicious or unreferenced files.
- Restrict the IIS worker process to least privilege, remove unused IIS modules and handlers, and prevent IIS from launching unauthorized binaries or script interpreters.
- Monitor for anomalous child processes spawned by w3wp.exe and unexpected outbound connections initiated by web servers.
- Monitor and restrict access to staging directories including C:\ProgramData, C:\Users\Public, C:\PerfLogs, and C:\Windows\Temp.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | check[.]office365-update[.]com | Command-and-control domain used by NOODLERAT samples attributed to SHADOW-EARTH-053 with low confidence. |
| IPV4 | 141[.]164[.]46[.]77 | External address contacted by the mdync.exe backdoor for beaconing. |
| IPV4 | 194[.]38[.]11[.]3 | Address serving ShadowPad and NOODLERAT samples, according to the article. |
| IPV4 | 209[.]141[.]40[.]254 | Address contacted by a VShell sample associated in the article with SHADOW-EARTH-054. |
| IPV4 | 96[.]9[.]125[.]227 | Command-and-control address used by GOST and Wstunnel tunnels and contacted by another deployed tunneling tool. |
| SHA256 | 2e8f9fd8213d9f69044101cd029fd1797ec7afbcad40bb1f04eb93d881c04cd2 | Hash of a legitimate signed executable abused by SHADOW-EARTH-053 for DLL sideloading. |
| SHA256 | 4264cfb3980a068ab36d842c7ee0942f40aaf308f31ed48b41e140e59885f5c8 | Hash of a legitimate signed executable abused by SHADOW-EARTH-053 for DLL sideloading. |
| SHA256 | 8d9433e9734dd629d74abe41ff7024c84b3a28c45671df8f4baed344de733c78 | Hash of a legitimate executable abused by SHADOW-EARTH-053 for DLL sideloading. |
| SHA256 | d67197bf407e74ecd77be89d0da107d5f7d37c21bdf55456c6b57df65cf429b3 | Hash of a legitimate signed executable abused by SHADOW-EARTH-053 for DLL sideloading. |
MITRE ATT&CK
T1003.001 · LSASS MemoryEvil-CreateDump and Mimikatz were used to target LSASS memory for credential extraction.T1003.002 · Security Account ManagerMimikatz was run with lsadump::sam to dump the local SAM database.T1003.006 · DCSyncThe group deployed newdcsync, which the researchers assessed was likely used for DCSync attacks.T1018 · Remote System DiscoveryThe group discovered domain controllers and enumerated machines in target domains.T1021.002 · SMB/Windows Admin SharesThe group copied web shells to internal Exchange servers over administrative shares.T1036.003 · Rename Legitimate UtilitiesThe group renamed Windows system binaries, including net.exe and PowerShell binaries, to randomized .log filenames to evade process-name detection.T1046 · Network Service DiscoveryDomainMachines.exe probed discovered machines across SMB, web, RDP, WinRM, database, and Kerberos-related ports.T1047 · Windows Management InstrumentationThe group used WMIC for lateral movement, including installing backdoors and tools on additional hosts.T1053.005 · Scheduled TaskA scheduled task named M1onltor was configured to run the sideloaded binary every five minutes with the highest privileges.T1087.002 · Domain AccountThe group enumerated domain users and accounts using PowerView's Get-DomainUser cmdlet and other commands.T1114.002 · Remote Email CollectionThe custom ExchangeExport tool collected mailbox content through the Exchange Web Services API.T1190 · Exploit Public-Facing ApplicationSHADOW-EARTH-053 exploited vulnerabilities in internet-facing Microsoft Exchange and IIS servers to gain initial access.T1505.003 · Web ShellThe group installed web shells, including GODZILLA, on compromised Exchange and IIS servers for persistence and command execution.T1550.002 · Pass the HashThe article describes lateral movement via Pass-the-Hash after the group enabled remote administrative access for local administrators.T1560.001 · Archive via UtilityThe attacker created a password-protected RAR archive containing a PST file.T1572 · Protocol TunnelingGOST and Wstunnel were used to tunnel SOCKS5 traffic through WebSocket and HTTPS connections.T1574.002 · DLL Side-LoadingThe group sideloaded malicious DLLs through legitimate signed executables to load ShadowPad.
CVE
CVE-2021-26855We have observed them targeting server-based N-day vulnerabilities, such as the ProxyLogon chain targeting Microsoft Exchange Server (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065).CVE-2021-26857We have observed them targeting server-based N-day vulnerabilities, such as the ProxyLogon chain targeting Microsoft Exchange Server (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065).CVE-2021-26858We have observed them targeting server-based N-day vulnerabilities, such as the ProxyLogon chain targeting Microsoft Exchange Server (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065).CVE-2021-27065We have observed them targeting server-based N-day vulnerabilities, such as the ProxyLogon chain targeting Microsoft Exchange Server (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065).CVE-2025-55182Separately, we found Linux NOODLERAT samples that were reportedly dropped via the exploitation of CVE-2025-55182 (React2Shell).
People
Threat Actors
APT41The article states that ShadowPad has been used by APT41 since 2017; it does not attribute SHADOW-EARTH-053 to APT41.CL-STA-0049Intrusion set referenced in comparison with SHADOW-EARTH-054; the article notes network and infrastructure overlaps but says the observed TTPs did not match.Earth AluxIntrusion set mentioned in relation to overlaps with CL-STA-0049 and REF7707, not as an attribution for SHADOW-EARTH-053.REF7707Intrusion set mentioned in relation to overlaps with CL-STA-0049 and Earth Alux, not as an attribution for SHADOW-EARTH-053.SHADOW-EARTH-053Temporary intrusion set designation used by the researchers for China-aligned activity targeting government and critical infrastructure entities.SHADOW-EARTH-054Separate temporary intrusion set discussed as having overlapping targets and tooling with SHADOW-EARTH-053; the researchers assess exploitation was independent.
Malware
FinalDraftWe know of two other intrusion sets using VARGEIT: Earth Alux and REF7707, where the malware is called FinalDraft.Godzillaand Internet Information Services (IIS) servers (e.g., ProxyLogon chain), then deploys web shells (GODZILLA) for persistent access and stages ShadowPad implants via DLL sideloading of legitimate signedmdync.exeThe mdync.exe backdoorNoodleRATSeparately, we found Linux NOODLERAT samples that were reportedly dropped via the exploitation of CVE-2025-55182 (React2Shell).ShadowPadservers (e.g., ProxyLogon chain), then deploys web shells (GODZILLA) for persistent access and stages ShadowPad implants via DLL sideloading of legitimate signed executables.SQUIDOORBoth the IP address and the domain name are listed in a report on CL-STA-0049, an intrusion set that primarily uses the SQUIDOOR malware (which we call VARGEIT).VARGEITBoth the IP address and the domain name are listed in a report on CL-STA-0049, an intrusion set that primarily uses the SQUIDOOR malware (which we call VARGEIT).VshellVShell
Vendors
Products
AnyDeskIn one instance, ShadowPad samples were delivered via AnyDesk, a legitimate remote administration tool, suggesting the attacker either leveraged a prior compromise or obtained credentials through other means.Exchange Web ServicesAdditionally, the threat actor used a custom “ExchangeExport” tool to export the mailbox content of high-profile users via the Exchange Web Services (EWS) API.Internet Information Services (IIS)The group exploits N-day vulnerabilities in internet-facing Microsoft Exchange and Internet Information Services (IIS) servers (e.g., ProxyLogon chain), then deploys web shells (GODZILLA) for persistent access andMicrosoft Exchange ServerWe have observed them targeting server-based N-day vulnerabilities, such as the ProxyLogon chain targeting Microsoft Exchange Server (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065).Microsoft WindowsThe attacker also deployed csvde.exe (a legitimate Windows utility) to export Active Directory objects to CSV format.
Tools
DomainMachines.exeWe also observed custom binary named DomainMachines.exe enumerating machines in the domain through LDAP, then connecting directly to ports related to SMB (139,445), web server and proxies (80, 443, 8080, 8443), RDPEvil-CreateDumpThe group collects credentials that can be used to further its objectives, notably through the use of the Evil-CreateDump tool.ExchangeExportAdditionally, the threat actor used a custom “ExchangeExport” tool to export the mailbox content of high-profile users via the Exchange Web Services (EWS) API.GOSTGOST (GO Simple Tunnel): An open-source tunnel written in Go, GOST was used to establish SOCKS5 proxies and WebSocket-based tunnels to external infrastructure.IOXIOX proxyMimikatzMimikatz was executed directly via rundll32.exe with command-line arguments for credential extraction (sekurlsa::logonpasswords) and local SAM database dumping (lsadump::sam).newdcsyncAdditionally, we observed the group dropping and executing a binary called newdcsync, which, based on the command line and filename, was likely used for DCSync attacks.PowerViewIt also used PowerView's Get-DomainUser cmdlet to enumerate user accounts and associated email addresses from a domain controller.RARWe observed the attacker deploying the RAR executable, and in one instance, we saw the creation of a password-protected RAR archive containing messages (a PST file) from an executive in the targeted company.RingQRingQSharp-SMBExecWe also observed the group deploying a suspected custom remote desktop protocol (RDP) launcher (under the name smss.exe) and a C# implementation of SMBExec known as Sharp-SMBExec.WstunnelWstunnel: Another open-source tunneling tool deployed as wt.exe, Wstunnel was configured to tunnel SOCKS5 traffic over HTTPS to the same command-and-control (C&C) IP address.
Countries
BrazilWe also identified targets unique to SHADOW-EARTH-054 in Malaysia, Brazil, and Taiwan, operating in similar industries to those targeted by SHADOW-EARTH-053, plus a telecommunications equipment reseller.India IndiaMalaysiaMalaysiaMyanmarMyanmarPakistanPakistanPolandNote that despite focusing on Asia, the threat actor’s footprint extended beyond this region, with at least one target in Poland.Sri LankaSri LankaTaiwanTaiwanThailandThailand
Industries
Critical infrastructureA China-aligned threat group is exploiting unpatched Microsoft Exchange vulnerabilities to conduct cyberespionage against government and critical infrastructure targets across Asia and beyond.DefenseInside Shadow-Earth-053: A China-Aligned Cyberespionage Campaign Against Government and Defense Sectors in AsiaGovernmentInside Shadow-Earth-053: A China-Aligned Cyberespionage Campaign Against Government and Defense Sectors in AsiaIT ConsultingIn at least two countries, we observed the group focusing on IT consulting firms holding government contracts, particularly those that listed the Ministry of Defense as one of their customers.TechnologyBeyond the government sector, SHADOW-EARTH-053 also targeted the technology industry.TelecommunicationsWe also identified targets unique to SHADOW-EARTH-054 in Malaysia, Brazil, and Taiwan, operating in similar industries to those targeted by SHADOW-EARTH-053, plus a telecommunications equipment reseller.TransportationFinally, we found limited number of victims within the transportation industry in Southeast Asia.