Exclusive A novel China-linked threat group infiltrated more than a dozen critical networks in Poland, Asian countries, and possibly beyond, beginning in December 2024 and with activity uncovered as recently as this month.

I'm concerned about what they are leaving behind: What type of C2 on a sleep cycle is still lingering in these environments?

In a report shared exclusively with The Register, TrendAI researchers say the new group, which they track as Shadow-Earth-053, targeted government agencies, defense contractors, technology firms, and the transportation industry. The Chinese spies typically gain initial access to victim environments via vulnerable Microsoft Exchange Servers. 

In "multiple" of these intrusions, they compromised victim organizations up to 8 months before deploying ShadowPad, a custom backdoor used by China's APT41 for almost a decade, and shared among multiple China-aligned groups since 2019.

About half of the victims were also compromised by a related group, Shadow-Earth-054, which exploited the same vulnerabilities and shared identical tool hashes and overlapping techniques with Shadow-Earth-053. The 054 group has some network overlaps with Chinese crews tracked as CL-STA-0049 by Palo Alto Networks' Unit 42, REF7707 by Elastic Security Labs, and Earth Alux.

Tom Kellermann, TrendAI VP of AI security and threat research, likened the new Chinese groups to Salt Typhoon and Volt Typhoon. 

Salt hacked telecommunications and government agencies to gain stealthy, long-term access to victim organizations going back as far as 2019. And Volt followed in mid-2021, burrowing deep into critical US networks to preposition for future destructive attacks. Neither of these hacking campaigns came to light until late 2023. 

"Shadow-Earth-053 followed Shadow-Earth-054, conducting reconnaissance and borrowing into the defense industries and defense ministries of nation states that are aligned with the US and also supportive of Taiwan's independence," Kellermann said in an exclusive interview with The Register. 

"I'm concerned about what they are leaving behind: What type of C2 on a sleep cycle is still lingering in these environments? Whether or not they have already prepositioned wipers or destructive capabilities," Kellermann continued. "They're following in the footsteps of the Typhoon campaigns, they look like the younger brother and sister of the Typhoon campaigns, and they're island-hopping through the defense sectors and ministries of those nations for a reason."

Shadow-Earth-053's victims spanned at least eight countries, according to TrendAI's investigation. Most of the observed targets were located in Pakistan, Thailand, Malaysia, India, Myanmar, Sri Lanka, and Taiwan, with at least one target - a defense-sector organization - in Poland.  

Kellermann also suggested that the network intruders are paying close attention to next month's summit between US President Trump and Chinese President Xi.

"Volt essentially had unrequited access to critical infrastructures, energy sector, etc., and it was all for the purposes of ongoing espionage, but most importantly, maintaining sabotage capability, like destructive attacks, should geopolitical tension exacerbate," Kellermann said in an exclusive interview with The Register. "Here we are, leading up to the May 14 and 15 meeting between President Trump and President Xi and, God forbid, the 15th goes sideways."

Exchange server bugs: the gifts that keep on giving

Shadow-Earth-053 typically exploits external services to hack into targeted networks. The years-old ProxyLogon (CVE-2021-26855), which can be chained with other Microsoft Exchange Server bugs (CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065) to achieve remote code execution, is a favorite. 

Salt Typhoon and other Chinese government snoops also abused ProxyLogon to breach critical US networks back in 2021, when it was first disclosed, and it's remained a top-exploited vulnerability ever since. So if you haven't already: patch these Exchange server bugs.

After compromising the sever, Shadow-Earth-053 installs web shells - Godzilla is a commonly used one with this and other China-based crews - and then deploys the ShadowPad backdoor.

In one instance, the snoops delivered ShadowPad malware via legitimate, and popular, remote desktop tool AnyDesk. TrendAI says this suggests the attacker either used a prior compromise or abused stolen credentials. "The limited visibility into this intrusion prevents us from determining whether this represents an alternative initial access method or a later-stage deployment following an unobserved entry point," the authors wrote. 

Shadow-y malware and legit Windows tools

In a separate instance, the incident responders found Linux NoodleRat backdoors - also widely used by Chinese espionage and cybercrime groups - deployed after Shadow-Earth-053 exploited another widely-abused Microsoft security hole: React2Shell (CVE-2025-55182), a critical flaw in React Server Components that can allow attackers to run arbitrary code on vulnerable servers.

The group takes measures to avoid being detected on networks and make their malicious traffic appear legitimate. In one victim's environment, TrendAI detected RingQ, an open-source tool developed in China and available on GitHub that can be used to pack malicious binaries to evade detection by security solutions. The intruders also use domain names that impersonate products, security companies, or are related to the DNS protocol.

• Chinese attackers are pwning your infrastructure to use in attacks, 10 countries warn
• Researcher claims Salt Typhoon spies attended Cisco training scheme
• This is the FBI, open up. China's Volt Typhoon is on your network
• FBI cyber cop: Salt Typhoon pwned 'nearly every American'

In some instances, the group renamed legitimate Windows system binaries to evade process-based detection. 

"They're using tools that we've seen before, and I think they are doing that on purpose, just to get lost in the noise," Kellermann said. 

To move laterally through victim environments, Shadow-Earth-053 uses Windows Management Instrumentation Command-line (WMIC) and installs backdoors onto additional hosts. In one environment, the group propagated web shells to additional internal Exchange servers by using existing administrative credentials - and they continue collecting credentials as they travel through compromised systems, using tools like Evil-CreateDump.

Targeting Poland, a NATO country, "highlights how cyber espionage and a cyber warfare is burgeoning," Kellermann said. "And not only is it burgeoning, but this is the direct prepositioning of these assets to colonize these infrastructures for the purpose of not just espionage, but long term sabotage, if need be." ®