Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Shadow-Earth-053 · Unknown · assessed origin China · misp-galaxy · refreshed 2026-10-06

Shadow-Earth-053

sigil · no ATT&CK coverage stated

What changed

ledger · newest first
  1. —todaynew CVE5 new CVEs: CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065, CVE-2025-55182

Analyst brief

misp-galaxy

SHADOW-EARTH-053 is a China-aligned threat group exploiting unpatched Microsoft Exchange Server vulnerabilities, specifically CVE-2021-26855, to conduct cyberespionage against government and defense-linked targets across Asia and Europe. The group primarily deploys ShadowPad malware, utilizing techniques such as credential dumping, tunneling tools, and lateral movement via WMIC. They have also been observed installing web shells for persistence and leveraging a custom ExchangeExport tool to extract high-value mailbox contents. Additionally, low-confidence associations with Noodle RAT and CVE-2025-55182 have been noted in their operations.

CVEs cited sources tie to Shadow-Earth-053

1 on CISA KEV
  1. CVE-2025-55182KEV2026-10-17
    1. “Separately, we found Linux NOODLERAT samples that were reportedly dropped via the exploitation of CVE-2025-55182 ( React2Shell ). We attribute these samples to SHADOW-EARTH-053 with low confidence.”

      attributed by a report · source: trendmicro.com ↗ · 2026-10-17

  2. CVE-2021-270652026-10-17
    1. “We have observed them targeting server-based N-day vulnerabilities, such as the ProxyLogon chain targeting Microsoft Exchange Server ( CVE-2021-26855 , CVE-2021-26857 , CVE-2021-26858 , and CVE-2021-27065 ).”

      cited as exploiting · named nearby · source: trendmicro.com ↗ · 2026-10-17

  3. CVE-2021-268582026-10-17
    1. “We have observed them targeting server-based N-day vulnerabilities, such as the ProxyLogon chain targeting Microsoft Exchange Server ( CVE-2021-26855 , CVE-2021-26857 , CVE-2021-26858 , and CVE-2021-27065 ).”

      cited as exploiting · named nearby · source: trendmicro.com ↗ · 2026-10-17

  4. CVE-2021-268572026-10-17
    1. “We have observed them targeting server-based N-day vulnerabilities, such as the ProxyLogon chain targeting Microsoft Exchange Server ( CVE-2021-26855 , CVE-2021-26857 , CVE-2021-26858 , and CVE-2021-27065 ).”

      cited as exploiting · named nearby · source: trendmicro.com ↗ · 2026-10-17

  5. CVE-2021-268552026-10-17
    1. “We have observed them targeting server-based N-day vulnerabilities, such as the ProxyLogon chain targeting Microsoft Exchange Server ( CVE-2021-26855 , CVE-2021-26857 , CVE-2021-26858 , and CVE-2021-27065 ).”

      cited as exploiting · named nearby · source: trendmicro.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

1 source
  1. 1.trendmicro.com/en_us/research/26/d/inside-shadow-earth-053.html

Track Shadow-Earth-053 on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.