SHADOW-EARTH-053 Exploits Microsoft Exchange Vulnerabilities in Asia

• •SHADOW-EARTH-053 exploits ProxyLogon vulnerabilities in Microsoft Exchange and IIS servers.
• •Targets include government ministries and defense contractors across Asia and a NATO member state.
• •Organizations must apply security updates and monitor for suspicious activities immediately.

The China-aligned threat group SHADOW-EARTH-053 has been exploiting unpatched Microsoft Exchange and IIS server vulnerabilities, specifically the ProxyLogon vulnerability chain, to conduct cyberespionage. This group has targeted government ministries, defense contractors, and transportation entities across at least eight Asian countries and one NATO member state. Their attack methods include deploying web shells and the ShadowPad malware through DLL sideloading and registry-based payload execution. Tools such as Mimikatz and custom credential theft utilities have been utilized, with persistence mechanisms involving registry changes and scheduled tasks. The activity highlights the ongoing risk posed by older vulnerabilities when combined with sophisticated post-compromise techniques. Organizations are urged to apply security updates for Microsoft Exchange and IIS, focusing on the ProxyLogon-related CVEs. Detection measures should include monitoring for unauthorized file creation and suspicious scheduled tasks. Immediate action is recommended to block outbound communications to identified malicious IP addresses.