China-Aligned SHADOW-EARTH-053 Exploits Exchange Servers to Deploy ShadowPad Malware

A China-aligned intrusion set tracked as SHADOW-EARTH-053 has been exploiting known but unpatched Microsoft Exchange (ProxyLogon CVEs CVE-2021-26855/26857/26858/27065) and IIS vulnerabilities since at least December 2024 to deploy ShadowPad via a three-file DLL sideloading chain, enumerate and export high-value mailboxes using EWS, and conduct cyberespionage against government, defense-related, and transportation targets across at least eight countries (including Poland); the report describes TTPs, shared tooling with SHADOW-EARTH-054, sample IoCs, and recommended mitigations such as patching, WAF/IPS, file integrity monitoring, privilege hardening, and process restrictions.