Shadow-Earth-053Threat actor
SHADOW-EARTH-053 is a China-aligned threat group exploiting unpatched Microsoft Exchange Server vulnerabilities, specifically CVE-2021-26855, to conduct cyberespionage against government and defense-linked targets across Asia and Europe. The group primarily deploys ShadowPad malware, utilizing techniques such as credential dumping, tunneling tools, and lateral movement via WMIC.From MISP Galaxy
Last reported 27 days ago, by CERT-EU2 reports
ATT&CK techniques
6 of 11 · each with the sentence it comes from- T1505.003Web Shell
“…abilities in internet-facing Microsoft Exchange and Internet Information Services (IIS) servers (e.g., ProxyLogon chain), then deploys web shells (GODZILLA) for persistent access and stages ShadowPad implants via DLL sideloading of legitimate signed executables.”
- T1003.006DCSync
“… observed the group dropping and executing a binary called newdcsync, which, based on the command line and filename, was likely used for DCSync attacks.”
- T1021.001Remote Desktop Protocol
“We also observed the group deploying a suspected custom remote desktop protocol (RDP) launcher (under the name smss.exe) and a C# implementation of SMBExec known as Sharp-SMBExec.”
- T1047Windows Management Instrumentation
“SHADOW-EARTH-053 uses Windows Management Instrumentation Command-line (WMIC) for lateral movement, installing backdoors and tools onto additional hosts.”
- T1053.005Scheduled Task
“Persistence was achieved via a Scheduled Task named M1onltor, configured to run the sideloaded binary every five minutes with the highest privileges.”
- T1195Supply Chain Compromise
“…ers to target government and defence organisations in Asia and Poland, while another China-linked threat actor enacted a global supply-chain compromise leveraging Daemon Tools installers distributed from the software's legitimate site.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Cyber Brief 26-06 - May 2026“Shadow-Earth-053 reportedly exploited unpatched Exchange servers”
-
Inside Shadow-Earth-053: A China-Aligned Cyberespionage Campaign Against Government and Defense Sectors in Asia“Inside Shadow-Earth-053: A China-Aligned Cyberespionage Campaign Against Government and Defense Sectors in Asia”
Indicators in its reports
named in the reports above- 4264cfb3980a068a…40e59885f5c8in 1 report
- 2e8f9fd8213d9f69…93d881c04cd2in 1 report
- 8d9433e9734dd629…d344de733c78in 1 report
- d67197bf407e74ec…7df65cf429b3in 1 report
- 141.164.46[.]77in 1 report
- 96.9.125[.]227in 1 report
- 194.38.11[.]3in 1 report
- check.office365-update[.]comin 1 report
- 209.141.40[.]254in 1 report
- zimbra-beta[.]infoin 1 report
Copy these 10 indicators · defanged
Thanks — we review every report.