Reported by 1 outlet
China-Backed SHADOW-EARTH-053 Deploys ShadowPad in Multi-Stage Espionage Campaign
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.00 / 2.0 · best outlet weight
- Severity
- 0.80 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
China-Backed SHADOW-EARTH-053 Deploys ShadowPad in Multi-Stage Espionage Campaign
cyberpress.org · 166d ago · May 1st, 2026
A newly tracked China-aligned intrusion set, SHADOW-EARTH-053, has been targeting government and critical infrastructure networks across Asia since at least December 2024, with one NATO member also in scope. Trend Micro reports the group exploits older Microsoft Exchange and IIS vulnerabilities, including the ProxyLogon chain, to gain initial access. After establishing a foothold, the attackers deploy GODZILLA web shells for persistence and stage ShadowPad — a backdoor widely associated with Chinese state espionage — through DLL sideloading of legitimate signed executables. The group employs a layered toolkit including IOX proxy, GOST, Wstunnel, WMIC, and custom loaders for lateral movement, credential theft, and mailbox collection targeting high-value users. The campaign demonstrates how China-aligned actors continue to exploit N-day vulnerabilities in legacy Exchange servers that many organizations have patched in theory but not in practice. Organizations with exposed Exchange/IIS servers should prioritize patching, implement virtual patching via IPS/WAF, and monitor for IIS spawning command shells or unusual outbound traffic from web servers.