A China-aligned intrusion campaign has targeted government entities and critical infrastructure across at least eight countries, with activity traced back to at least December 2024, according to TrendAI. Researchers Daniel Lunghi and Lucas Silva published their findings on 30 April 2026, attributing the activity to a temporary intrusion set they designate SHADOW-EARTH-053.
What the Campaign Did
The attackers gained initial access by exploiting long-unpatched vulnerabilities in internet-facing Microsoft Exchange and IIS servers — chiefly the ProxyLogon family (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065). From there, attackers installed GODZILLA web shells under innocuous filenames such as error.aspx, warn.aspx, and tunnel.ashx in standard Exchange and IIS paths, giving persistent remote command access. TrendAI also found Linux NOODLERAT samples reportedly dropped through CVE-2025-55182 (React2Shell), a critical flaw in React Server Components, but attributes those samples to SHADOW-EARTH-053 only with low confidence.
The final payload — ShadowPad, a modular backdoor used by APT41 since 2017 and shared among multiple China-aligned groups since 2019 — arrived via DLL sideloading. Attackers abused legitimate, signed executables (including a renamed Toshiba Bluetooth binary) to load the implant, and in one instance delivered ShadowPad samples through AnyDesk. Encrypted payloads were stored in the registry and deleted after initial execution to reduce forensic traces.
Once inside, according to TrendAI's report, the attackers moved laterally using Windows Management Instrumentation Command-line (WMIC) and pulled credentials from LSASS memory with Evil-CreateDump and Mimikatz. They exported the mailbox content of high-profile users through the Exchange Web Services API, and in one case packed an executive's messages into a password-protected RAR archive.
Who Was Targeted
TrendAI says most observed targets were government entities in seven Asian countries: Pakistan, Thailand, Malaysia, India, Myanmar, Sri Lanka, and Taiwan. At least one target was in Poland, a NATO member, which TrendAI describes as a European government, bringing the total to eight countries across two continents. In at least two countries the group focused on IT consulting firms holding government contracts, including firms that list the Ministry of Defence as a customer, and TrendAI also found a limited number of victims in Southeast Asian transportation. No victim has been named, and RECATOOLS has not independently verified them. Three ASEAN member states are directly represented: Thailand, Malaysia, and Myanmar.
A Related Cluster Compounds the Picture
TrendAI also identified a second, independently operating cluster, SHADOW-EARTH-054, which overlaps with SHADOW-EARTH-053 in tooling, initial access vectors and victims. Nearly half of SHADOW-EARTH-053's targets were also hit by SHADOW-EARTH-054, primarily in Malaysia, Sri Lanka, and Myanmar. TrendAI says the evidence suggests independent exploitation of the same vulnerabilities rather than direct operational coordination. SHADOW-EARTH-054 also has some network overlaps with Unit 42's CL-STA-0049 and Elastic's REF7707, two intrusion sets that in turn overlap with Earth Alux.
Tom Kellermann, VP of AI security and threat research at TrendAI, described the campaign in an interview in terms that go beyond technical tradecraft: "They're following in the footsteps of the Typhoon campaigns, they look like the younger brother and sister of the Typhoon campaigns, and they're island-hopping through the defense sectors and ministries of those nations for a reason." Kellermann further flagged concern about what the groups may have pre-positioned: "What type of C2 on a sleep cycle is still lingering in these environments?"
Why Unpatched Exchange Servers Remain the Entry Point
The ProxyLogon vulnerability chain dates to March 2021. In 2026 it still gives attackers reliable initial access to government and defence networks in several countries, which points to a persistent failure of patch management in sectors that any compliance standard would expect to have closed these gaps years ago. TrendAI's low-confidence link to CVE-2025-55182, a React Server Components flaw, suggests the cluster may also be adding newer vectors, but the confirmed entry point remains flaws that were patched years ago.
Defenders in affected sectors should treat any Exchange or IIS server below current patch level as one that may already be compromised, and should hunt for GODZILLA web shell indicators of compromise before they patch it. TrendAI publishes indicators of compromise alongside its report, and Industrial Cyber and The Register have also covered the findings.
Defensive Posture
For organisations in ASEAN government and defence supply chains, the first check is patch status on Exchange and IIS, along with React Server Components on any internet-facing deployment. Exchange directories are worth searching for anomalous ASP.NET files, and server infrastructure for outbound connections to AnyDesk endpoints that IT never provisioned. Network defenders should also review LSASS access logs and watch for RAR archiving on mail servers, since both fit the exfiltration pattern seen in this campaign.
This summary draws on TrendAI's published research and on secondary coverage of it, and reproduces no exploit code or operational attack detail beyond what has already been made public.
Correction, 18 October 2026: An earlier version said the campaign also targeted diaspora journalists and civil society activists; TrendAI's research reports no such targeting, and that passage and the verdict built on it have been removed. The publication date is corrected to 30 April 2026, an unsupported claim that this was the broadest such operation disclosed in 2026 has been removed, and the description of victims, the React2Shell link and the relationship between the two clusters now follow TrendAI's report.
View author profile → · Editorial policy
