Adversary Intelligence — 2026-05-02

China-Aligned Attackers Deploy ShadowPad and IOX Proxy in Multi-Stage Espionage Campaign

Trend Micro published research on April 30 identifying a China-aligned threat group designated Shadow-Earth-053 deploying ShadowPad malware, IOX proxy tools, and WMIC-based execution in a multi-stage espionage campaign against government and defense sector networks in Asia and Poland. ShadowPad, a modular backdoor with documented links to Chinese Ministry of State Security-affiliated threat clusters, served as the primary implant in the campaign. The group used IOX proxy tunneling to blend command-and-control traffic with legitimate network administration activity, complicating both host- and network-based detection. The Hacker News, The Register, and Cybersecurity News amplified the Trend Micro findings, with The Register noting the geographic breadth of targeting across both Indo-Pacific and European networks.

Analysis
ShadowPad's documented MSS-affiliated lineage positions Shadow-Earth-053 as state-directed rather than criminal, with Poland's inclusion alongside Asian government and defense targets pointing to central tasking across Indo-Pacific and European policy equities. IOX proxy tunneling over WMIC execution reflects deliberate tradecraft to blend C2 traffic with legitimate administrative activity, complicating both host- and network-based detection. All reporting derives from a single Trend Micro dataset with no independent corroborating telemetry. The targeting profile is also consistent with a contracted intelligence vendor fulfilling external client requirements rather than a directly controlled MSS unit. Researchers will likely disclose at least one additional ShadowPad deployment in a new sector or geography within the next 60 days.

4 sources

China-Aligned Attackers Use ShadowPad, IOX Proxy, and WMIC in Multi-Stage Espionage Campaign - The Hacker News
Inside Shadow-Earth-053: A China-Aligned Cyberespionage Campaign Against Government and Defense Sectors in Asia - Trend Micro
Chinese spy group caught lurking in Poland, Asia networks - The Register
China-Aligned Attackers Use ShadowPad, IOX Proxy, and WMIC in Multi-Stage Espionage Campaign - Cybersecurity News