A China-aligned threat cluster tracked as SHADOW-EARTH-053 has been exploiting unpatched Microsoft Exchange and IIS servers through the ProxyLogon vulnerability chain to deploy web shells and install the ShadowPad malware family. The group relies on DLL sideloading through legitimate signed binaries, registry-based payload execution, and multiple tunneling tools to preserve covert command-and-control access. Observed victims include government ministries, defense-linked contractors, and transportation entities across several Asian countries as well as one NATO member state. The activity highlights the ongoing danger posed by older Exchange flaws when paired with mature post-compromise tradecraft.
Researchers documented web shell deployment using filenames such as error.aspx and tunnel.ashx in common IIS directories, followed by ShadowPad delivery through DLL sideloading with trusted executables such as runtimebroker.exe . They also identified additional backdoors, including mdync.exe , communicating with external infrastructure, while tunneling tools such as GOST, Wstunnel, and code.exe were staged in C:\Users\Public . Credential theft activity involved Mimikatz and custom utilities like Evil-CreateDump and newdcsync , executed via the IIS worker process. Persistence was supported through registry changes such as LocalAccountTokenFilterPolicy and scheduled tasks including M1onltor .
Organizations should apply all available security updates for Microsoft Exchange Server and IIS, with priority given to the ProxyLogon-related CVEs. Web application firewalls or intrusion prevention controls should be configured to block exploit attempts before execution. Defenders should also enforce file integrity monitoring on web-facing directories and prevent unauthorized creation of .aspx , .ashx , or .jsp files. Additional hardening steps include restricting IIS process permissions, reducing write access, monitoring child processes launched by w3wp.exe , disabling unused services, and applying application allow-listing on critical servers.
Security teams should alert on the appearance of unknown .aspx or .ashx files within IIS paths and on scheduled tasks named M1onltor . Detection coverage should also include execution of tools such as Mimikatz and PowerView, as well as DLL sideloading activity involving signed binaries. Outbound communication to the identified malicious IP addresses and the domain check[.]office365-update[.]com should be blocked immediately. Incident responders should then perform forensic review of suspicious values under HKEY_CURRENT_USER\Software and remove any unauthorized scheduled tasks or persistence artifacts.
Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.
Attack Narrative & Commands: An adversary has obtained a custom tunneling binary (e.g., tunnel.exe ) on the compromised host. To avoid detection during initial download, the binary is staged in C:ProgramData , a directory commonly writable by standard users and frequently used for legitimate installations. After staging, the attacker will later execute the tool to establish a covert channel. The staging step is performed with PowerShell’s Copy-Item , producing a file‑creation event that matches the detection rule’s path criteria.
Regression Test Script:
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
