China-Linked Hackers Target Asian Governments, NATO State, Journalists, and Activists

Trend Micro and Citizen Lab reporting describes coordinated China-aligned espionage activity: SHADOW-EARTH-053 has exploited unpatched Microsoft Exchange/IIS vulnerabilities to deploy Godzilla web shells and ShadowPad (via DLL sideloading) across government and defense targets in South, East and Southeast Asia (and Poland), while GLITTER CARP and SEQUIN CARP run credential-harvesting and AiTM phishing campaigns against journalists and diaspora activists; tactics include AnyDesk distribution, Mimikatz, custom RDP/SMB tools, tunneling utilities, and reuse of phishing infrastructure, with recommendations to patch systems and deploy IPS/WAF virtual patching.