China-Aligned Attackers Use ShadowPad, IOX Proxy, and WMIC in Multi-Stage Espionage Campaign

A China-aligned APT campaign (SHADOW-EARTH-053/054) has been conducting targeted cyberespionage across at least eight countries since December 2024 by exploiting unpatched Microsoft Exchange and IIS (ProxyLogon CVE-2021-26855/26857/26858/27065) to deploy ShadowPad via DLL sideloading, web shells (e.g., GODZILLA), credential-harvesting tools, and tunneling utilities, maintaining long-term persistence and lateral movement in government and critical infrastructure networks.