China-Aligned SHADOW-EARTH

Cybersecuritynews •Tushar Subhra Dutta • May 5, 2026

A China-aligned threat group tracked as SHADOW-EARTH-053 has been exploiting unpatched Microsoft Exchange Server vulnerabilities to conduct cyberespionage against government and defense-linked targets across Asia and beyond. The group’s activity dates back to at least December 2024, with campaigns targeting at least eight countries, including government ministries, defense contractors, IT consulting firms, and transportation organizations […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SHADOW-EARTH-053 Exploits Microsoft Exchange Vulnerabilities in Asia The China-aligned threat group SHADOW-EARTH-053 has been exploiting unpatched Microsoft Exchange and IIS server vulnerabilities, specifically the ProxyLogon vulnerability chain, to conduct cyberespionage. This group has targeted government ministries, defense contractors, and transportation entities across at least eight Asian countries and one NATO member state. Their attack methods include deploying web shells and the ShadowPad malware through DLL sideloading and registry-based payload execution. Tools such as Mimikatz and custom credential theft utilities have been utilized, with persistence mechanisms involving registry changes and scheduled tasks. The activity highlights the ongoing risk posed by older vulnerabilities when combined with sophisticated post-compromise techniques. Organizations are urged to apply security updates for Microsoft Exchange and IIS, focusing on the ProxyLogon-related CVEs. Detection measures should include monitoring for unauthorized file creation and suspicious scheduled tasks. Immediate action is recommended to block outbound communications to identified malicious IP addresses. 2 sources 81

Extracted Entities

China-Aligned SHADOW-EARTH

The full story

Extracted Entities

APT Groups (2)

Attack Types (1)

Industries (2)

MITRE ATT&CK (1)

Platforms (1)