SHADOW-EARTH-053 Exploits Microsoft Exchange Vulnerabilities in Asia

SHADOW-EARTH-053, a China-aligned threat actor, has been actively exploiting unpatched Microsoft Exchange and IIS ProxyLogon vulnerabilities to compromise government ministries, defense contractors, and transportation organizations across at least eight Asian countries and one NATO member state; intrusions involve web shells, ShadowPad via DLL sideloading and registry execution, credential theft (Mimikatz), registry and scheduled-task persistence, and the report urges immediate patching and monitoring.