# SHADOW-EARTH-053 — China-Aligned Cyberespionage Campaign Exploiting Microsoft Exchange (ProxyLogon CVE-2021-26855/26857/26858/27065) and IIS to Deploy GODZILLA Web Shells and ShadowPad

> SHADOW-EARTH-053 is a China-aligned cyberespionage intrusion set tracked by Trend Micro (TrendAI Research) that has, since at least December 2024, exploited N-day vulnerabilities in internet-facing Microsoft Exchange (ProxyLogon chain — CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065) and IIS servers to plant GODZILLA web shells and stage ShadowPad implants via DLL sideloading of legitimately signed binaries. The actor targets government, defense, transportation, and IT-consulting organizations across Pakistan, Thailand, Malaysia, India, Myanmar, Sri Lanka, Taiwan, and NATO member Poland, and shares identical tooling and TTPs with a related set tracked as SHADOW-EARTH-054.

- **Published:** 2026-05-11T12:00:00Z
- **Last reviewed:** 2026-05-11T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0493
- **ID:** TL-2026-0493
- **Severity:** HIGH (CVSS 9.8)
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** SHADOW-EARTH-053 (China)
- **Detections:** 9 · **IOCs:** 33 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065, CVE-2025-55182

## Description

SHADOW-EARTH-053 (designation assigned by Trend Micro's TrendAI Research, disclosed 2026-04-30) is a China-aligned cyberespionage intrusion set whose campaign has been active since at least December 2024 against government ministries, defense agencies, defense-contractor IT consultancies, and transportation entities in South and Southeast Asia, with confirmed targeting extending to NATO member Poland. The campaign is notable for its aggressive exploitation of long-known but still-unpatched N-day flaws in internet-facing Microsoft Exchange Server (the ProxyLogon chain: CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065) and IIS, demonstrating that mature CVEs continue to deliver real-world initial access against under-resourced government and defense-adjacent environments more than five years after disclosure.

Initial access is overwhelmingly achieved by chaining the ProxyLogon Server-Side Request Forgery (CVE-2021-26855), Insecure Deserialization in Exchange Unified Messaging (CVE-2021-26857), and post-authentication arbitrary file-write primitives (CVE-2021-26858, CVE-2021-27065) to drop GODZILLA ASP.NET web shells under Exchange front-end paths (C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth) and IIS publishing roots (C:\inetpub\wwwroot\aspnet_client\system_web). Operators repeatedly stage shells under inconspicuous filenames designed to blend with Exchange and OWA assets — error.aspx, errorFE.aspx, signout.aspx, warn.aspx, data.aspx, page.aspx, TimeinLogout.aspx, timeout.aspx, charcode.aspx, tunnel.ashx, i.aspx, 2.aspx — and use the shells both for immediate command execution and as long-lived footholds. A subset of intrusions delivered ShadowPad via abused AnyDesk remote access, and a low-confidence cluster of Linux NOODLERAT samples was reportedly dropped via the React2Shell vulnerability (CVE-2025-55182).

Post-exploitation, SHADOW-EARTH-053 stages a multi-stage Windows implant chain built on DLL sideloading of legitimately signed executables. Trend documented at least four sideload pairs: GameHook.exe (signer ORANGE VIEW LIMITED) loading graphics-hook-filter32.dll; imecmnt.exe (Microsoft Corporation signer) loading imjp14k.dll; xReport.exe (Mainline Net Holdings Limited signer) loading Uxtheme.dll; and Samsung Electronics' LUManager.EXE loading MPS.dll. Sideloaded payloads decrypt and execute a 32-bit older-builder ShadowPad variant — distinguished from current campaigns by the absence of advanced obfuscation and anti-debugging primitives — whose encrypted body is persisted in the registry under HKEY_CURRENT_USER\Software\[ComputerName] in a binary value named 'scode'. Execution is achieved through callback injection via EnumDesktopsA, and persistence is established with a scheduled task named 'M1onltor' configured to run the sideloaded binary every five minutes at highest privileges. Secondary implants observed in the campaign include a TosBtKbd.dll registry-loaded payload sideloaded via the Toshiba Bluetooth Stack binary (renamed from CIATosBtKbd.exe), and a custom beaconing backdoor mdync.exe.

For egress and pivoting, SHADOW-EARTH-053 deploys multiple open-source tunneling and proxy utilities, frequently renamed to masquerade as legitimate Windows components: IOX proxy (renamed explorer.exe), GOST (Go Simple Tunnel — SOCKS5 plus WebSocket transport), Wstunnel (wt.exe — SOCKS5 over HTTPS), and tunnel-core.exe renamed to code.exe. Lateral movement uses WMIC, Sharp-SMBExec (a C# implementation of SMBExec), a custom RDP launcher delivered as smss.exe, and web-shell propagation across administrative shares. Credential access combines Evil-CreateDump (a modified create-dump.exe used against the LSASS process), Mimikatz invoked via rundll32 (sekurlsa::logonpasswords and lsadump::sam), and a 'newdcsync' tool consistent with DCSync against domain controllers. Discovery activity includes PowerView's Get-DomainUser, AD export via csvde.exe, domain-controller enumeration with nltest /dclist, and a 28KB custom LDAP-plus-port scanner named DomainMachines.exe.

Defensive evasion relies on the open-source Chinese-origin RingQ packer, on renaming legitimate Windows binaries (net.exe, powershell.exe) to randomized $[RANDOM].log filenames before execution, and on staging tools in common world-writable paths (C:\Users\Public, C:\ProgramData, C:\PerfLogs, C:\Windows\Temp). Collection and exfiltration centre on the Exchange mailbox itself: operators archive PST content into password-protected RAR files and use a custom 'ExchangeExport' tool that invokes the EWS API alongside Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn to enumerate target mailboxes. C2 infrastructure overlaps domains designed to mimic Microsoft cloud services (check.office365-update.com) and collaboration tools (zimbra-beta.info), and four operator-controlled IPs (141.164.46.77, 96.9.125.227, 194.38.11.3, 209.141.40.254). Trend assesses with high confidence that SHADOW-EARTH-053 is China-aligned given victimology consistent with Chinese strategic interests, language artefacts in tooling, reuse of China-origin open-source tradecraft (RingQ, GOST, IOX), and shared hashes/TTPs with the related SHADOW-EARTH-054 cluster (assessed as Type A collaboration: independent exploitation by sibling groups, not coordinated operations).

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1047 Windows Management Instrumentation
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1505.003 Server Software Component: Web Shell
- T1574.001 DLL
- T1027.002 Obfuscated Files or Information: Software Packing
- T1036.005 Match Legitimate Resource Name or Location
- T1112 Modify Registry
- T1140 Deobfuscate/Decode Files or Information
- T1218.011 System Binary Proxy Execution: Rundll32
- T1070.004 Indicator Removal: File Deletion
- T1003.001 OS Credential Dumping: LSASS Memory
- T1003.006 OS Credential Dumping: DCSync
- T1003.002 OS Credential Dumping: Security Account Manager
- T1087.002 Account Discovery: Domain Account
- T1018 Remote System Discovery
- T1482 Domain Trust Discovery
- T1021.001 Remote Services: Remote Desktop Protocol
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1570 Lateral Tool Transfer
- T1114.002 Email Collection: Remote Email Collection
- T1560.001 Archive Collected Data: Archive via Utility
- T1572 Protocol Tunneling
- T1090 Proxy
- T1071.001 Application Layer Protocol: Web Protocols
- T1041 Exfiltration Over C2 Channel

## Sources

- [Inside Shadow-Earth-053: A China-Aligned Cyberespionage Campaign Against Government and Defense Sectors in Asia](https://www.trendmicro.com/en_us/research/26/d/inside-shadow-earth-053.html)
- [Microsoft Security Response Center — Multiple Security Updates Released for Exchange Server](https://msrc.microsoft.com/blog/2021/03/multiple-security-updates-released-for-exchange-server/)
- [CISA Alert AA21-062A — Mitigate Microsoft Exchange Server Vulnerabilities](https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-062a)
- [NVD — CVE-2021-26855 (ProxyLogon SSRF)](https://nvd.nist.gov/vuln/detail/CVE-2021-26855)
- [NVD — CVE-2021-26857 (Exchange Unified Messaging Insecure Deserialization)](https://nvd.nist.gov/vuln/detail/CVE-2021-26857)
- [NVD — CVE-2021-26858 (Exchange Post-Auth Arbitrary File Write)](https://nvd.nist.gov/vuln/detail/CVE-2021-26858)
- [NVD — CVE-2021-27065 (Exchange Post-Auth Arbitrary File Write)](https://nvd.nist.gov/vuln/detail/CVE-2021-27065)
- [NVD — CVE-2025-55182 (React2Shell)](https://nvd.nist.gov/vuln/detail/CVE-2025-55182)
- [MITRE ATT&CK — ShadowPad (S0596)](https://attack.mitre.org/software/S0596/)
- [MITRE ATT&CK — Godzilla (S1101)](https://attack.mitre.org/software/S1101/)
- [Microsoft Threat Intelligence — HAFNIUM Targeting Exchange Servers with 0-Day Exploits](https://www.microsoft.com/en-us/security/blog/2021/03/02/hafnium-targeting-exchange-servers/)
- [Volexity — Operation Exchange Marauder: Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnerabilities](https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0493