China-Aligned Shadow-Earth-053 Breached Exchange Servers for Long-Term Espionage
Threat Actor Intelligence · 10 sources · Updated 4mo ago · First seen Apr 30, 2026
Trend Micro disclosed that the China-aligned cluster SHADOW-EARTH-053 compromised more than a dozen organizations in at least eight countries by exploiting vulnerable Microsoft Exchange and IIS servers, including the ProxyLogon chain, then deploying GODZILLA web shells and the ShadowPad backdoor to maintain access. Victims included government agencies, defense contractors, technology firms, transportation organizations, and at least one target in Poland, with activity observed from December 2024 through April 2026. Researchers said the intrusions resemble broader Chinese state-linked operations such as Salt Typhoon and Volt Typhoon and may support long-term espionage, prepositioning, and potential future disruption.
Post-compromise activity included DLL sideloading with a renamed Toshiba Bluetooth Stack executable, registry-resident shellcode execution via EnumDesktopsA callback injection, scheduled-task persistence, mailbox collection from Exchange, credential theft, and lateral movement using tools such as IOX, GOST, Wstunnel, Sharp-SMBExec, Mimikatz, and Evil-CreateDump. Trend Micro also identified overlap with a related cluster, SHADOW-EARTH-054, including shared tool hashes, reused vulnerabilities, and compromises at some of the same organizations, although the company assessed the relationship as overlapping exploitation rather than clearly coordinated operations. Defenders were urged to patch Exchange and IIS systems quickly and review IIS worker process activity, web-shell indicators, and other signs of stealthy post-exploitation.
