Adversary Intelligence — 2026-05-02

China-Aligned Espionage Group Deploys ShadowPad Against Asian Governments and NATO-State Defense Sector

Trend Micro researchers, in a report shared exclusively with The Register on April 30, identified SHADOW-EARTH-053, a China-aligned intrusion cluster active since at least December 2024 against government, defense, and transportation targets in at least eight countries, including Taiwan and Poland, with activity observed through April 2026. The group exploits the ProxyLogon vulnerability chain against unpatched Exchange and IIS servers, deploys Godzilla web shells for persistence, and delivers ShadowPad via DLL sideloading of legitimate signed executables. Trend Micro reported that nearly half the victims were also compromised by a related cluster, SHADOW-EARTH-054, which shares identical tool hashes and overlaps with groups tracked separately as CL-STA-0049, Earth Alux, and REF7707. Post-compromise tooling included IOX, GOST, and Wstunnel for tunneling; Evil-CreateDump and Mimikatz for credential access; and WMIC for lateral movement, with RingQ deployed to pack binaries against endpoint detection.

Analysis
The simultaneous targeting of Taiwan and a NATO member state signals collection priorities tied to PRC concerns about Taiwan contingency planning and allied force posture, per a single Trend Micro report shared exclusively with The Register. Nearly 50% victim overlap with SHADOW-EARTH-054 and identical tool hashes across both clusters indicate shared procurement infrastructure or deliberate coordination within a broader campaign architecture. The overlap more plausibly reflects China's contractor ecosystem distributing common tooling across nominally separate teams than a single unified campaign, putting the true operational footprint well beyond SHADOW-EARTH-053 and complicating attribution to any discrete state actor. Additional public attribution campaigns are very likely by August 2026.

3 sources

Chinese spy group caught lurking in Poland, Asia networks - The Register
China-Linked Hackers Target Asian Governments, NATO State, Journalists, and Activists - The Hacker News
China-Aligned Hackers Deploy ShadowPad in Multi-Stage Espionage Campaign - GBHackers