SHADOW-EARTH-053 Exchange/IIS espionage against government and defense networks

**SHADOW-EARTH-053** is exploiting internet-facing **Microsoft Exchange** and **IIS** systems to break into government and defense networks across South, East, and Southeast Asia and Poland. After access, the operators deploy **Godzilla** web shells for persistence and command execution, then stage **ShadowPad** through **AnyDesk** and DLL sideloading. At least one intrusion chain also used **CVE-2025-55182** to deliver **Linux Noodle RAT**. The activity has been active since at least December 2024 and uses tunneling, privilege-escalation, and lateral-movement tooling including **IOX**, **GOST**, **Wstunnel**, **RingQ**, **Mimikatz**, **Sharp-SMBExec**, and custom RDP tooling. Available evidence indicates nearly half of the identified targets, including organizations in Malaysia, Sri Lanka, and Myanmar, were also previously compromised by a related intrusion set. Trend Micro recommends applying security updates and cumulative patches to exposed systems, or using IPS or WAF virtual patching when immediate updates are not feasible, while the full scope of compromise remains unquantified.