SHADOW-EARTH-053 — China-Aligned Cyberespionage Campaign Exploiting Microsoft Exchange (ProxyLogon CVE-2021-26855/26857/26858/27065) and IIS to Deploy GODZILLA Web Shells and ShadowPad

SHADOW-EARTH-053 (TL-2026-0493), also tracked as SHADOW-EARTH-053, is a high-severity advanced persistent threat campaign scored CVSS 9.8, first published 2026-05-11. It is attributed to SHADOW-EARTH-053 (China) with high confidence, affects Microsoft Exchange Server, references 5 CVEs (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858), maps to 29 MITRE ATT&CK techniques (T1003.001, T1003.002, T1003.006), and is covered by 9 detection rules and 33 indicators of compromise.

Key facts for TL-2026-0493

Threat ID
TL-2026-0493
Also known as
SHADOW-EARTH-053, Shadow Earth 053, TrendAI SHADOW-EARTH-053
Severity
HIGH
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
APT
First published
2026-05-11
Last reviewed
2026-05-11
Attribution
SHADOW-EARTH-053
Attribution confidence
HIGH
Nation-state nexus
China
Motivation
ESPIONAGE
Target sectors
government, defense, it-consulting, transportation
Target regions
South Asia, Southeast Asia, Europe, Asia-Pacific
Detection rules
9
Indicators of compromise
33

Malware and tooling in SHADOW-EARTH-053

Malware and tooling: GODZILLA, NOODLERAT, ShadowPad, DomainMachines.exe, Evil-CreateDump, GOST, IOX, Mimikatz, PowerView, RingQ, ShadowPad, Sharp-SMBExec

SHADOW-EARTH-053 is a China-aligned cyberespionage intrusion set tracked by Trend Micro (TrendAI Research) that has, since at least December 2024, exploited N-day vulnerabilities in internet-facing Microsoft Exchange (ProxyLogon chain — CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065) and IIS servers to plant GODZILLA web shells and stage ShadowPad implants via DLL sideloading of legitimately signed binaries. The actor targets government, defense, transportation, and IT-consulting organizations across Pakistan, Thailand, Malaysia, India, Myanmar, Sri Lanka, Taiwan, and NATO member Poland, and shares identical tooling and TTPs with a related set tracked as SHADOW-EARTH-054.

How SHADOW-EARTH-053 works

SHADOW-EARTH-053 (designation assigned by Trend Micro's TrendAI Research, disclosed 2026-04-30) is a China-aligned cyberespionage intrusion set whose campaign has been active since at least December 2024 against government ministries, defense agencies, defense-contractor IT consultancies, and transportation entities in South and Southeast Asia, with confirmed targeting extending to NATO member Poland. The campaign is notable for its aggressive exploitation of long-known but still-unpatched N-day flaws in internet-facing Microsoft Exchange Server (the ProxyLogon chain: CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065) and IIS, demonstrating that mature CVEs continue to deliver real-world initial access against under-resourced government and defense-adjacent environments more than five years after disclosure.

Initial access is overwhelmingly achieved by chaining the ProxyLogon Server-Side Request Forgery (CVE-2021-26855), Insecure Deserialization in Exchange Unified Messaging (CVE-2021-26857), and post-authentication arbitrary file-write primitives (CVE-2021-26858, CVE-2021-27065) to drop GODZILLA ASP.NET web shells under Exchange front-end paths (C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth) and IIS publishing roots (C:\inetpub\wwwroot\aspnet_client\system_web). Operators repeatedly stage shells under inconspicuous filenames designed to blend with Exchange and OWA assets — error.aspx, errorFE.aspx, signout.aspx, warn.aspx, data.aspx, page.aspx, TimeinLogout.aspx, timeout.aspx, charcode.aspx, tunnel.ashx, i.aspx, 2.aspx — and use the shells both for immediate command execution and as long-lived footholds. A subset of intrusions delivered ShadowPad via abused AnyDesk remote access, and a low-confidence cluster of Linux NOODLERAT samples was reportedly dropped via the React2Shell vulnerability (CVE-2025-55182).

Post-exploitation, SHADOW-EARTH-053 stages a multi-stage Windows implant chain built on DLL sideloading of legitimately signed executables. Trend documented at least four sideload pairs: GameHook.exe (signer ORANGE VIEW LIMITED) loading graphics-hook-filter32.dll; imecmnt.exe (Microsoft Corporation signer) loading imjp14k.dll; xReport.exe (Mainline Net Holdings Limited signer) loading Uxtheme.dll; and Samsung Electronics' LUManager.EXE loading MPS.dll. Sideloaded payloads decrypt and execute a 32-bit older-builder ShadowPad variant — distinguished from current campaigns by the absence of advanced obfuscation and anti-debugging primitives — whose encrypted body is persisted in the registry under HKEY_CURRENT_USER\Software\[ComputerName] in a binary value named 'scode'. Execution is achieved through callback injection via EnumDesktopsA, and persistence is established with a scheduled task named 'M1onltor' configured to run the sideloaded binary every five minutes at highest privileges. Secondary implants observed in the campaign include a TosBtKbd.dll registry-loaded payload sideloaded via the Toshiba Bluetooth Stack binary (renamed from CIATosBtKbd.exe), and a custom beaconing backdoor mdync.exe.

For egress and pivoting, SHADOW-EARTH-053 deploys multiple open-source tunneling and proxy utilities, frequently renamed to masquerade as legitimate Windows components: IOX proxy (renamed explorer.exe), GOST (Go Simple Tunnel — SOCKS5 plus WebSocket transport), Wstunnel (wt.exe — SOCKS5 over HTTPS), and tunnel-core.exe renamed to code.exe. Lateral movement uses WMIC, Sharp-SMBExec (a C# implementation of SMBExec), a custom RDP launcher delivered as smss.exe, and web-shell propagation across administrative shares. Credential access combines Evil-CreateDump (a modified create-dump.exe used against the LSASS process), Mimikatz invoked via rundll32 (sekurlsa::logonpasswords and lsadump::sam), and a 'newdcsync' tool consistent with DCSync against domain controllers. Discovery activity includes PowerView's Get-DomainUser, AD export via csvde.exe, domain-controller enumeration with nltest /dclist, and a 28KB custom LDAP-plus-port scanner named DomainMachines.exe.

Defensive evasion relies on the open-source Chinese-origin RingQ packer, on renaming legitimate Windows binaries (net.exe, powershell.exe) to randomized $[RANDOM].log filenames before execution, and on staging tools in common world-writable paths (C:\Users\Public, C:\ProgramData, C:\PerfLogs, C:\Windows\Temp). Collection and exfiltration centre on the Exchange mailbox itself: operators archive PST content into password-protected RAR files and use a custom 'ExchangeExport' tool that invokes the EWS API alongside Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn to enumerate target mailboxes. C2 infrastructure overlaps domains designed to mimic Microsoft cloud services (check.office365-update.com) and collaboration tools (zimbra-beta.info), and four operator-controlled IPs (141.164.46.77, 96.9.125.227, 194.38.11.3, 209.141.40.254). Trend assesses with high confidence that SHADOW-EARTH-053 is China-aligned given victimology consistent with Chinese strategic interests, language artefacts in tooling, reuse of China-origin open-source tradecraft (RingQ, GOST, IOX), and shared hashes/TTPs with the related SHADOW-EARTH-054 cluster (assessed as Type A collaboration: independent exploitation by sibling groups, not coordinated operations).

MITRE ATT&CK techniques used in TL-2026-0493

Credential Access

T1003.001 OS Credential Dumping: LSASS Memory; T1003.002 OS Credential Dumping: Security Account Manager; T1003.006 OS Credential Dumping: DCSync

Discovery

T1018 Remote System Discovery; T1087.002 Account Discovery: Domain Account; T1482 Domain Trust Discovery

Lateral Movement

T1021.001 Remote Services: Remote Desktop Protocol; T1021.002 Remote Services: SMB/Windows Admin Shares; T1570 Lateral Tool Transfer

Defense Evasion

T1027.002 Obfuscated Files or Information: Software Packing; T1036.005 Match Legitimate Resource Name or Location; T1070.004 Indicator Removal: File Deletion; T1140 Deobfuscate/Decode Files or Information; T1218.011 System Binary Proxy Execution: Rundll32

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1047 Windows Management Instrumentation; T1053.005 Scheduled Task/Job: Scheduled Task; T1059.001 Command and Scripting Interpreter: PowerShell; T1059.003 Command and Scripting Interpreter: Windows Command Shell

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1090 Proxy; T1572 Protocol Tunneling

defense-impairment

T1112 Modify Registry

Collection

T1114.002 Email Collection: Remote Email Collection; T1560.001 Archive Collected Data: Archive via Utility

Initial Access

T1133 External Remote Services; T1190 Exploit Public-Facing Application

Persistence

T1505.003 Server Software Component: Web Shell

stealth

T1574.001 DLL

Affected products and versions in SHADOW-EARTH-053

  • Microsoft — Exchange Server
    Vulnerable versions: 2013 CU23 and earlier (unpatched); 2016 CU19 and earlier (unpatched); 2019 CU8 and earlier (unpatched)
    Fixed in: 2013 CU23 + March 2021 SU; 2016 CU19/CU20 + SU; 2019 CU8/CU9 + SU
  • Microsoft — Internet Information Services (IIS)
    Vulnerable versions: IIS hosting unpatched ASP.NET applications exposed to the internet
  • React2Shell — React2Shell component
    Vulnerable versions: versions affected by CVE-2025-55182

Remediation for SHADOW-EARTH-053

Patches

  • Microsoft KB5000871 / March 2021 Exchange Server Security Updates and all subsequent Cumulative Updates for Exchange Server 2013, 2016, and 2019.
  • Apply vendor patches for CVE-2025-55182 (React2Shell) on affected Linux web-stack assets.

Immediate actions

  • Patch all internet-facing Microsoft Exchange Servers against the ProxyLogon chain (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065) with Microsoft's March 2021 security updates and all subsequent cumulative updates — Exchange 2013 CU23, 2016 CU19/CU20, 2019 CU8/CU9.
  • Block the documented C2 IPs (141.164.46.77, 96.9.125.227, 194.38.11.3, 209.141.40.254) and domains (check.office365-update.com, zimbra-beta.info) at perimeter firewalls, DNS sinkholes, and proxy egress.
  • Hunt OWA and IIS web roots (C:\inetpub\wwwroot\aspnet_client\system_web and C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth) for the documented GODZILLA web shell filenames — error.aspx, errorFE.aspx, signout.aspx, warn.aspx, data.aspx, page.aspx, TimeinLogout.aspx, timeout.aspx, charcode.aspx, tunnel.ashx, i.aspx, 2.aspx.
  • Search the registry for HKEY_CURRENT_USER\Software\[ComputerName] keys containing binary 'scode' values, and scheduled tasks named 'M1onltor'.
  • Hunt for all four documented SHA-256 sideload-pair payloads and review every host where GameHook.exe, imecmnt.exe, xReport.exe, or LUManager.EXE has executed from a non-standard path.

Workarounds

  • If patching of Exchange is not immediately possible, apply Microsoft's ProxyLogon mitigation script (EOMT) and disable internet-facing OWA/ECP.
  • Restrict outbound network access from Exchange servers to known mail-flow endpoints to disrupt ShadowPad C2 and tunneling traffic.

Longer-term hardening

  • Decommission or fully isolate Exchange Server versions that no longer receive security updates; migrate to Exchange Online or supported on-premises versions.
  • Implement application allowlisting (Windows Defender Application Control / AppLocker) to break DLL sideloading by enforcing signature-and-path policies on signed-executable hosts.
  • Deploy EDR with detections for LSASS handle access, credential dumping, EnumDesktopsA callback injection, and rundll32-driven Mimikatz invocations.
  • Enforce LSASS protection (RunAsPPL), Credential Guard, and Restricted Admin / remote credential guard to defeat Mimikatz and Evil-CreateDump style dumping.
  • Reduce internet exposure of Exchange Server, place behind a VPN/ZTNA gateway, and require MFA on OWA, ECP, and EWS.
  • Audit and restrict EWS API usage; alert on Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn invocations and on bulk mailbox export operations.

CVEs associated with SHADOW-EARTH-053

CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065, CVE-2025-55182

Weaknesses (CWE) in SHADOW-EARTH-053

CWE-918, CWE-502, CWE-22, CWE-78, CWE-94

Timeline of SHADOW-EARTH-053

  • Microsoft and Volexity disclose the ProxyLogon zero-day chain (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065) attributed to HAFNIUM, and Microsoft releases out-of-band Exchange Server security updates.
  • CISA issues emergency alert AA21-062A urging immediate Exchange Server patching against the ProxyLogon chain.
  • Earliest observed SHADOW-EARTH-053 intrusions against South and Southeast Asian government targets, exploiting unpatched on-premises Microsoft Exchange Servers.
  • CVE-2025-55182 (React2Shell) is disclosed and subsequently used in a low-confidence cluster to deliver Linux NOODLERAT samples linked to SHADOW-EARTH-053 tradecraft.
  • TrendAI Research observes overlapping SHA-256 hashes and DLL sideloading pairs between SHADOW-EARTH-053 and a sibling cluster, leading to designation of SHADOW-EARTH-054 (Type A collaboration assessment).
  • First confirmed SHADOW-EARTH-053 intrusion against a Polish government-adjacent target, extending the targeting set to NATO members.
  • Trend Micro publishes 'Inside Shadow-Earth-053' detailing the campaign, victimology, full TTPs, sideload pairs, and IOCs.
  • Threadlinqs Intelligence publishes TL-2026-0493 with full MITRE mapping, IOCs, detection coverage, and simulation playbooks for SHADOW-EARTH-053.
  • As of 2026-05-29, SHADOW-EARTH-053 remains an active China-aligned espionage campaign: Trend Micro disclosed it 2026-04-30 as ongoing since Dec 2024, recently expanding to NATO member Poland, with no takedown reported. Its ProxyLogon chain (CVE-2021-26855 et al., in CISA KEV) is still actively exploited in 2026 against ~91% of unpatched internet-facing Exchange servers.

Sources cited for SHADOW-EARTH-053

Threats related to SHADOW-EARTH-053

Detection coverage for TL-2026-0493

As of 2026-05-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0493 across Splunk SPL, Microsoft KQL and Sigma, covering 33 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats