A new espionage campaign linked to a China-aligned group has been identified, targeting various government and defense entities across Asia and one NATO member in Europe. Trend Micro has labeled this activity as part of the threat cluster known as SHADOW-EARTH-053, which has been operational since at least December 2024.
The campaign primarily impacts nations including Pakistan, Thailand, Malaysia, India, Myanmar, Sri Lanka, and Taiwan, with Poland being the only European target. Researchers have noted that nearly half of the victims also faced prior attacks from a related group, SHADOW-EARTH-054, although no direct coordination between the two has been established.
Exploitation of known vulnerabilities in Microsoft Exchange and Internet Information Services servers allows the group to install web shells, such as Godzilla, for sustained access. This leads to the deployment of additional malware, including the ShadowPad backdoor via DLL sideloading. Tools like Mimikatz are employed for privilege escalation, while lateral movement utilizes a custom RDP launcher and Sharp-SMBExe.