Threat Intelligence / Actor / SHADOW-EARTH-053

SHADOW-EARTH-053

Nation: China · 1 tracked threat(s) · Categories: APT

Also known as: Shadow-Earth-053, Earth Shadow 053, TrendAI SHADOW-EARTH-053 cluster

Tracked threats

SHADOW-EARTH-053 — China-Aligned Cyberespionage Campaign Exploiting Microsoft Exchange (ProxyLogon CVE-2021-26855/26857/26858/27065) and IIS to Deploy GODZILLA Web Shells and ShadowPad — HIGH

Full actor intelligence — infrastructure, IOCs, detection coverage and operator fingerprints — is available via the Threadlinqs MCP server (Purple tier). View plans →

Threadlinqs Intelligence