SHADOW-EARTH-053 Cyberespionage Against Asian Government Sectors

SHADOW-EARTH-053 is a China-aligned threat actor conducting extensive cyberespionage campaigns primarily targeting governmental, defense-adjacent, and technology sectors across South and Southeast Asia. The group demonstrates a high level of persistence, often exploiting unpatched vulnerabilities in internet-facing Microsoft Exchange and IIS servers to deploy web shells and maintain long-term access. There is significant evidence of "Type A" collaboration or independent infrastructure overlap with another set, SHADOW-EARTH-054, suggesting a common supply chain for tools and exploits.

The group's technical tradecraft involves sophisticated defense evasion, such as retrieving shellcode from the Windows Registry and executing it via callback injection (EnumDesktopsA) to bypass monitoring. They utilize a modular toolkit including ShadowPad, NOODLERAT, and various open-source proxies like GOST and Wstunnel for redundant command-and-control (C&C). The campaign's strategic focus on government contracts and high-profile mailboxes indicates a mission centered on intelligence collection and intellectual property theft.

This activity is particularly critical due to the group's exploitation of CVE-2025-55182 (React2Shell) and their ability to move laterally using custom tools like Evil-CreateDump and Sharp-SMBExec. Organizations in the targeted regions, particularly those managing Exchange infrastructure, should prioritize patching and monitor for the specific process-renaming and registry-based persistence techniques described in this report.