ProxyLogon was disclosed in March 2021. Five years later, SHADOW-EARTH-053 is still using it to walk into government ministries across seven countries. That’s not a novel attack. That’s a commentary on patch management discipline, or the lack of it, in sectors that should know better.
SHADOW-EARTH-053 is a China-aligned cyberespionage intrusion cluster active against government ministries, defence organisations, and critical infrastructure across South, East, and Southeast Asia since at least December 2024, with confirmed reach into at least one NATO member state. Detailed analysis from Trend Micro and Broadcom/Symantec, published in April–May 2026, documents a campaign that is technically disciplined without being technically novel: a combination that works precisely because defenders have grown complacent about vulnerabilities they believe they’ve addressed.
The breadth of targeting is what makes this campaign notable: government ministries, defence contractors, IT consultancies holding Ministry of Defence contracts, journalists, and civil society activists all appear in the same operational scope. That’s not a random collection. It’s a mandate that spans both foreign intelligence collection and domestic surveillance objectives.
Attribution and Related Activity
SHADOW-EARTH-053 is Trend Micro’s temporary designation for an activity cluster assessed to be China-aligned. Tooling overlaps exist with Earth Alux and REF7707 (previously documented Chinese-nexus espionage actors), though SHADOW-EARTH-053 is treated as a distinct cluster pending further evidence of operational coordination.
The attribution anchor is ShadowPad. This modular remote access trojan has been used almost exclusively by Chinese state-sponsored and contractor groups since it replaced PlugX as the preferred implant of the PLA Strategic Support Force ecosystem in the early 2020s. ShadowPad’s presence in a campaign is a strong attribution indicator. Its appearance here is consistent with a Chinese state nexus, and no credible alternative attribution exists.
A related intrusion set, SHADOW-EARTH-054, was found to have compromised nearly half of the same targets using identical tool hashes and overlapping TTPs. Researchers assess independent exploitation of the same vulnerabilities rather than direct coordination, suggesting parallel tasking by the same sponsoring authority, or opportunistic piggybacking on established footholds. Not a coincidence either way.
The Target Map and What It Tells Us
Primary targeting focuses on government ministries and defence organisations in Pakistan, Thailand, Malaysia, India, Myanmar, Sri Lanka, and Taiwan. Every country on that list represents a strategic intelligence priority for Beijing: regional rivals, Belt and Road partner states, and countries with active territorial or political tensions with China.
Poland is the outlier, and its presence matters. A NATO member state on the alliance’s eastern flank, with a significant defence industrial base and a frontline position in European security discussions. Chinese intelligence collection priorities there are multiple: NATO military planning, European political sentiment on Taiwan, and the flow of weapons to Ukraine. The question isn’t why China would want access to Polish government and defence networks. The question is why anyone would be surprised.
Beyond direct government targets, SHADOW-EARTH-053 also compromised IT consulting firms listing the Ministry of Defence as a client. Supply chain targeting of this type is a well-established Chinese espionage technique. APT10’s Operation Cloud Hopper demonstrated the playbook clearly. Third-party suppliers with weaker security postures, holding contracts with high-value government clients, are proxies for direct government access. The defence contractor’s network is the back door into the ministry.
The targeting of journalists and civil society activists, documented by The Diplomat which identified the same campaign infrastructure used against Uyghur community organisations and pro-democracy media, confirms the dual mandate. Foreign intelligence collection and transnational repression operate from the same infrastructure in the same campaign. That’s Beijing’s approach consistently: the technical infrastructure is shared, the objectives are both served simultaneously.
How They Get In — and Stay In
Unpatched Exchange and IIS: Still Working in 2026
SHADOW-EARTH-053 exploits N-day vulnerabilities in internet-facing Microsoft Exchange and IIS servers. The ProxyLogon chain (CVE-2021-26855 and related CVEs) has been disclosed for five years. CISA and NCSC have issued repeated advisories. And this group is still using it successfully in 2025–2026 operations.
That success is not an indictment of the group’s capabilities. It’s an indictment of patching discipline across government and critical infrastructure sectors in the affected regions. The attack surface should have closed years ago. It hasn’t.
GODZILLA Web Shells for Persistent Access
Post-exploitation access is established via GODZILLA web shells dropped to Exchange or IIS server paths following initial exploitation. GODZILLA is an open-source web shell framework with Java and PHP variants, supporting encrypted C2 communications that make it harder to detect through network traffic inspection. The web shell provides persistent access that survives reboots and doesn’t depend on running processes that endpoint detection tools might flag. It just sits there, waiting.
ShadowPad via AnyDesk DLL Sideloading
The primary implant is ShadowPad, deployed through DLL sideloading using AnyDesk as the carrier. The mechanics: a legitimate, digitally signed AnyDesk executable that loads a DLL by name without verifying its path is placed alongside a malicious DLL with the matching name. When the legitimate executable runs, it loads the malicious DLL, executing attacker code under the cover of a trusted process.
Using AnyDesk specifically is tactically deliberate. AnyDesk is widely deployed for legitimate remote support. Its presence on enterprise systems is unremarkable. Network defenders monitoring for anomalous process activity are less likely to flag AnyDesk connections as suspicious. Combined with ShadowPad’s encrypted C2 communications, that gives the adversary persistent access with a low detection probability in environments that aren’t specifically hunting for this technique.
ShadowPad’s modular architecture allows the operator to deploy additional capabilities post-infection (keyloggers, credential harvesters, data exfiltration modules) without deploying additional tooling that might trigger detection. The core implant is the platform; capabilities are added as needed.
ShadowPad in Context
ShadowPad’s history traces to PlugX and a 2017 supply chain compromise of NetSarang server management software, one of the earlier high-profile examples of Chinese actors using software supply chains for broad compromise. Since then, it has appeared in confirmed operations by APT41, APT15, and numerous PLASSF-affiliated groups. Its continued operational deployment in 2026 reflects the strategic decision to maintain a shared tooling platform across Chinese contractor and state-sponsored operations: a decision that aids attribution even as it provides operational capability.
The persistence of ProxyLogon as a viable attack vector in this and other recent campaigns contradicts the narrative that advisory-driven patch cycles close vulnerabilities in a reasonable timeframe. In high-value government and critical infrastructure sectors, they demonstrably don’t.
What to Do
For government and defence organisations: Internet-facing Exchange and IIS infrastructure needs to be at current patch levels. If this is not already the case, it should be treated as an emergency rather than a maintenance backlog item. Five years of advisories on ProxyLogon and its continued exploitation in 2026 campaigns is evidence that advisory-driven patching alone is insufficient. Someone needs to verify the state of every internet-facing Exchange and IIS server against current patch levels, today.
Beyond patching: audit web shell presence. GODZILLA and similar web shells are placed in predictable paths. Microsoft’s Exchange Emergency Mitigation Service and purpose-built web shell scanners should be run against affected server classes. Assume that any unpatched or inadequately remediated Exchange server in the affected regions may already have a web shell present.
For IT service providers to government: You are a target, not a bystander. Organisations holding government contracts should treat themselves as high-priority espionage targets. Implement network segmentation between government-client-facing systems and internal infrastructure. Conduct regular threat hunts for ShadowPad-associated indicators. The assumption that the adversary’s interest stops at the ministry’s front door is wrong.
For all sectors: Hunt for DLL sideloading activity, particularly where signed executables like AnyDesk appear in unexpected file paths alongside unknown DLLs. Review AnyDesk deployment policies: if it’s not actively used in your environment, block its execution. Hunt for GODZILLA web shell indicators in IIS and Exchange logs.
Trend Micro and Broadcom have published IoCs including ShadowPad C2 infrastructure, GODZILLA web shell hashes, and DLL sideloading artefacts. Import them into your threat intelligence platforms and build detection rules. The campaign is active and ongoing.
Assessment
SHADOW-EARTH-053 is technically disciplined, operationally patient, and structured to maintain persistent access over extended periods rather than conduct rapid exploitation. The simultaneous targeting of government ministries, defence contractors, and civil society activists reflects a mandate that spans both foreign intelligence collection and domestic surveillance objectives, consistent with how Chinese state-sponsored operations have operated across multiple documented campaigns.
Poland’s inclusion extends the significance beyond Asia. As NATO members increase defence spending and deepen military cooperation in response to the war in Ukraine, Chinese intelligence collection against alliance infrastructure is structural, not opportunistic.
The technical barriers to this campaign are low. Unpatched Exchange servers are widespread. The adversary has demonstrated capability and intent to sustain operations over extended periods. For organisations in the affected sectors and regions, the relevant question isn’t whether this actor is targeting their environment. It’s whether they would know if it already had.