Shadow-Earth-054

SHADOW-EARTH-054 is a related China-aligned intrusion cluster observed in connection with SHADOW-EARTH-053. Reporting describes substantial overlap in victimology, tooling, infrastructure, and tradecraft between the two clusters. SHADOW-EARTH-054 exploited the same vulnerable internet-facing Microsoft Exchange and IIS entry points, including the ProxyLogon chain, and in multiple cases compromised organizations months before ShadowPad deployment associated with SHADOW-EARTH-053. The cluster shared identical tool hashes and overlapping TTPs with SHADOW-EARTH-053, including web-shell-based persistence on vulnerable IIS or Exchange servers; identical hashes were specifically noted for tools such as Evil-CreateDump and IOX Proxy. In three recent cases, a malicious loader family was attributed to SHADOW-EARTH-054. Nearly half of the observed SHADOW-EARTH-053 victims were also compromised by SHADOW-EARTH-054, particularly in Malaysia, Sri Lanka, and Myanmar. Content also notes network overlaps between SHADOW-EARTH-054 and activity tracked by other vendors as CL-STA-0049, REF7707, and Earth Alux. Although the overlap suggests aligned Chinese intelligence priorities and a shared operational ecosystem among China-aligned espionage actors, the reporting explicitly states that no evidence of direct operational coordination between SHADOW-EARTH-054 and SHADOW-EARTH-053 was observed. No aliases beyond SHADOW-EARTH-054 / Shadow-Earth-054 are directly provided in the content.