PULSE NAME
Inside Shadow-Earth-053: A China-Aligned Cyberespionage Campaign Against Government and Defense Sectors in Asia
WHITE SHADOW-EARTH-053 AlienVault 2026-04-30 Modified: 2026-05-29
94
IOCs
HIGH VOLUME
A China-aligned threat group designated SHADOW-EARTH-053 has been conducting cyberespionage operations against government entities and critical infrastructure across at least eight countries in South, East, and Southeast Asia, plus one NATO member state, since December 2024. The group exploits unpatched Microsoft Exchange vulnerabilities, particularly the ProxyLogon chain, to gain initial access and deploys GODZILLA web shells for persistence. ShadowPad implants are staged via DLL sideloading of legitimate signed executables. Nearly half of the compromised environments showed overlap with another intrusion set, SHADOW-EARTH-054, sharing identical tooling including Evil-CreateDump and IOX proxy. The attackers conduct extensive Active Directory reconnaissance, credential harvesting, and mailbox exfiltration targeting high-profile government officials and defense contractors. Multiple tunneling tools including GOST and Wstunnel establish covert command-and-control channels, while lateral movement leverages WM...
Indicators of Compromise (94)
All FileHash-MD5 FileHash-SHA1 FileHash-SHA256 IPv4 domain hostname CVE
TYPEINDICATORDESCRIPTIONCREATED
FileHash-MD5 0933fbd16c7a8b70199f5612e147a22c 2026-04-30
FileHash-MD5 2616e7ec2d6c4b86a7fa1f4a762ae918 2026-04-30
FileHash-MD5 531da3715b1e4fc9baeaa034888ac419 2026-04-30
FileHash-MD5 a85459a1ec90a52b5c1f2f5a12bb2d10 2026-04-30
FileHash-SHA1 128f3ad395f86be6569ef2a957d42902a910de6c 2026-04-30
FileHash-SHA1 211e1fc502152ea272edb5a81a5b4405a28c48f9 2026-04-30
FileHash-SHA1 2dc1ad07b7529af3ba5c11a58519681909971a81 2026-04-30
FileHash-SHA1 2dd614427b80cdd38e8bbe0ace24a484671c0da2 2026-04-30
FileHash-SHA1 31b3dd9ee46805b0ed6e6dd6a5ee17facadfd2ff 2026-04-30
FileHash-SHA1 3229ba46dd54802093c81e6e2123fd1520faf960 2026-04-30
FileHash-SHA1 35cc0b684b0906aed9d672a1a8635510fe91aa67 2026-04-30
FileHash-SHA1 36061be6ccd17e87e3d1ef15f8e7058f279439d1 2026-04-30
FileHash-SHA1 3f858c007d4d49dd7fa260bcc786c34d4f78dbf5 2026-04-30
FileHash-SHA1 4541e55b70ca12ae4a79e38c0b4c31f067eb5cdc 2026-04-30
FileHash-SHA1 579bc9a640ac939b1f75eda852815f063cebd332 2026-04-30
FileHash-SHA1 824f13f758ce278f72a4aeaf1e15a703d5107dd7 2026-04-30
FileHash-SHA1 861a686461ad830b268977808ba56730616c7684 2026-04-30
FileHash-SHA1 8a5ac2682d70eacff7eb554e242227c82e2baa94 2026-04-30
FileHash-SHA1 9244cd99a27a8741a78e0b449cea063fdcfb0090 2026-04-30
FileHash-SHA1 95015643ecb3ba321b8cff8eca2907e5356e8659 2026-04-30
FileHash-SHA1 9a83466f6c34e588ba3e99d6cbfac0102e173cdd 2026-04-30
FileHash-SHA1 ac7ffce58c70fb9f837e11a44d655d6c28e276f5 2026-04-30
FileHash-SHA1 b8d586d376b342b08b3dd8a77c788480e025ad12 2026-04-30
FileHash-SHA1 e1bcf36ed2f7a60dd0dde52abf11c942e2657e31 2026-04-30
FileHash-SHA1 ebfd92291714e6d7e57cf4830aa8f87950b796bb 2026-04-30
FileHash-SHA1 ec38a56f9368eac67106a4ad61538e12053f03d1 2026-04-30
FileHash-SHA256 03a89ea5a8604e8bc09a4249211e20404a2c7047adda65a57deeb46abb1fb116 2026-04-30
FileHash-SHA256 0c63857269205f6505c259a56ea53b23b2bf7432aabb8647d59b321232ca7e36 2026-04-30
FileHash-SHA256 0c8c562ed7343d28c76d93a88bd0534440d0e71292ebcee66314d6d5c2f34403 2026-04-30
FileHash-SHA256 0eb72c1f1605d999488d903021d82a9ff4b937e6c1a1da50c55440f018e83ad9 2026-04-30
FileHash-SHA256 0eda83335334d3c877578326a5843d3e2a3b745834de27eac00b694262e2b1ed 2026-04-30
FileHash-SHA256 0fff684fa209cb79ab1104da3cfbbf4c950078e14e54c2564d130abbd4e464a9 2026-04-30
FileHash-SHA256 165cc3a9a40e04c469e5c818943920f38dc48db2c2365f1a71bb52c9582f0ea9 2026-04-30
FileHash-SHA256 188c72b101cd8ad96ef971e8943bddb3acd9dc45fe1d8719217d171e600a29aa 2026-04-30
FileHash-SHA256 1a5da90175ff7b55ddafcdb816adf574b92a112604019b219d82adab820fb3a2 2026-04-30
FileHash-SHA256 23c2ebc8f9bac96b2fbbb9b00b457c48d65a9f66ec24fbfba339eeefd0539ad7 2026-04-30
FileHash-SHA256 26f4c7f37448911310adf20e6e74aac60e92b97591f4ac9e5e21cc503be8da16 2026-04-30
FileHash-SHA256 2dd93edc8cc64747a7ca94b6827dc4e5b1e385d493ed4450272dd1dfc52a6255 2026-04-30
FileHash-SHA256 3dffbfcb825a70e477474e88b18679557ef467de37fc26e45ddbe572f520c52a 2026-04-30
FileHash-SHA256 3f6382418d0137f6ecbef23bfd981938bb86a935b27203f5b053e3710e835f97 2026-04-30
FileHash-SHA256 4173c218efe31a6b36df714cf4e1073696f3acbe7edd1b7fcba01e4a2d923a27 2026-04-30
FileHash-SHA256 41f74c3fc32752b5c7b88e7a5723441cb827958bc21b647fffae469407f1ce99 2026-04-30
FileHash-SHA256 4f77b4fcfde7abb7e6d0e36104e433abfed3a9d9938bf7fbe0e9d1a0b2ccf265 2026-04-30
FileHash-SHA256 55e929971a7975c7f9dfa4d677d5ec357af23a4ca208ef8f920804743e9011cd 2026-04-30
FileHash-SHA256 5bf35daaf26508fc136157818ead48cc5c7fa3a3e6273cde2c757673586a78a6 2026-04-30
FileHash-SHA256 5eb2122c4c645543966b07b94faccb5b4697561163382f21fb3b793b0d5cc9fe 2026-04-30
FileHash-SHA256 75d0d5080afd091114818d082babc418ccb43d545d9fda1fb715af6c129b6e51 2026-04-30
FileHash-SHA256 83e9f99a377566cf30df0ad71ca8522613b14d45e3e2eaead4a336509d26bef3 2026-04-30
FileHash-SHA256 884601e54fc2e6833167d33436b68e952020cdb99507b2807feec1bc086027c2 2026-04-30
FileHash-SHA256 8df8282da75ebe6cf1a535739991e3f298f903974a05966503d7fd2919ecea4e 2026-04-30
FileHash-SHA256 97ea803792929f802388e9d0e75a3c79c28260d589bc2d87902c73c729ed6f9e 2026-04-30
FileHash-SHA256 996fb4f7d1b3150490380c4ce9c7c3d60fac33bd6a7c1e3a46487021964cf3bb 2026-04-30
FileHash-SHA256 9dda789b85fce6294f91a79b7271a93de36dfcef21fc680dc2bf4235141e47df 2026-04-30
FileHash-SHA256 a5477ff2b3d6d475558abf03878dff0cca98c20c17aae35a8ad8e99e03293f89 2026-04-30
FileHash-SHA256 a65483b86847995a67de0fcb2a5487cdbc96361cb2e9dea8ab74005c8fef65ce 2026-04-30
FileHash-SHA256 b8a2a9ca58fb2b383a52f8be75cae44f08f2c3f8907bd8661ee8a4a78fd7dda3 2026-04-30
FileHash-SHA256 c935ded2729f0513672e261170d73d4e0e13a9b837f104d840c44a39b84c0d71 2026-04-30
FileHash-SHA256 d083b6d82765faffe738ebd0678c8eb01c1f1fac8d3c51ffdfe40e34da3ce902 2026-04-30
FileHash-SHA256 e12c2682a7949661fa99bf46723a1405c658d109411de3bf6cb04c57337cc020 2026-04-30
FileHash-SHA256 eff699456ed4c5938d53afdb8df0836d7cb953ed933ed1a2899ec43f6f9e540b 2026-04-30
FileHash-SHA256 f19a67b9c8805b335676f0fc17495839327f8135f791aa11d5d9adba2c83cc1c 2026-04-30
FileHash-SHA256 f43748a809680a23272ec684a8cce9af071ad165c3b01acdcd7fe501a0949745 2026-04-30
IPv4 194.38.11.3 2026-04-30
IPv4 96.9.125.227 2026-04-30
domain microsi0ft.com 2026-04-30
domain zimbra-beta.info 2026-04-30
domain zimbra.life 2026-04-30
hostname cert.kaspersky.icu 2026-04-30
hostname check.dnsmaps.com 2026-04-30
hostname check.office365-update.com 2026-04-30
hostname dns.dnserver.life 2026-04-30
hostname dns.dnsmap.icu 2026-04-30
hostname erp.kaspersky.icu 2026-04-30
hostname news.kaspersky.icu 2026-04-30
hostname ns1.group-ib.icu 2026-04-30
hostname ns1.kaspersky.icu 2026-04-30
hostname ns2.group-ib.icu 2026-04-30
hostname ns2.kaspersky.icu 2026-04-30
hostname nslookup.dnserver.life 2026-04-30
hostname router.dnserver.life 2026-04-30
hostname time.microsofttrends.com 2026-04-30
hostname update.kaspersky.icu 2026-04-30
hostname ww12.dnserver.life 2026-04-30
hostname www.group-ib.icu 2026-04-30
hostname www.kaspersky.icu 2026-04-30
CVE CVE-2021-26855 2026-04-30
CVE CVE-2021-26857 2026-04-30
CVE CVE-2021-26858 2026-04-30
CVE CVE-2021-27065 2026-04-30
CVE CVE-2025-55182 2026-04-30
FileHash-MD5 7c698dd4090564b179309c2a64266424 2026-04-30
FileHash-MD5 e5e0e0c0fadacee1105bd340fa1b2e6d 2026-04-30
FileHash-SHA1 82eb4b752c60b99b451f7a53b8ac856afe9deb88 2026-04-30
FileHash-SHA1 c2870caa5f016822fdaf16e3c470f96eefd4b93f 2026-04-30