{"id":60629,"date":"2026-04-30T00:00:00","date_gmt":"2026-04-30T00:00:00","guid":{"rendered":"urn:uuid:7d202be3-a35b-5b0d-d853-63fba7a1967a"},"modified":"2026-04-30T00:00:00","modified_gmt":"2026-04-30T00:00:00","slug":"inside-shadow-earth-053-a-china-aligned-cyberespionage-campaign-against-government-and-defense-sectors-in-asia","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/inside-shadow-earth-053-a-china-aligned-cyberespionage-campaign-against-government-and-defense-sectors-in-asia\/","title":{"rendered":"Inside Shadow-Earth-053: A China-Aligned Cyberespionage Campaign Against Government and Defense Sectors in Asia"},"content":{"rendered":"

<\/p>\n

<\/div>\n

Table 1. Legitimate executables vulnerable to DLL sideloading abused by SHADOW\u2011EARTH\u2011053<\/sup><\/p>\n

<\/span><\/h2>\n

SHADOW-EARTH-053 uses a legitimate Toshiba Bluetooth Stack executable, renamed to CIATosBtKbd.exe<\/i>, to sideload a malicious DLL (TosBtKbd.dll<\/i>). This loader employs a multistage evasion technique by retrieving its payload from the Windows Registry rather than embedding it within the binary. Upon execution, the loader calls GetComputerNameA<\/i> to identify the host and access a machine-specific registry key at HKEY_CURRENT_USER\\Software\\[ComputerName]<\/i>. From here, it retrieves a binary value named scode<\/i>, which contains the shellcode payload.<\/p>\n

The malware then allocates memory using VirtualAlloc (configured with PAGE_EXECUTE_READWRITE<\/i> permissions) and executes the shellcode via callback injection. By passing the shellcode\u2019s address as a callback parameter to the legitimate Windows API function EnumDesktopsA<\/i>, the malware tricks the operating system into executing the malicious code during standard desktop enumeration. This method avoids direct execution calls that often trigger security monitoring systems. Persistence was achieved via a Scheduled Task named M1onltor<\/i>, configured to run the sideloaded binary every five minutes with the highest privileges. Note that the specific shellcode payload could not be retrieved for analysis.<\/p>\n

<\/span><\/h2>\n

In several attacks, an executable named mdync.exe<\/i>” was deployed on the victim’s network. Although the file could not be retrieved for static analysis, endpoint telemetry reveals that the executable established beaconing connections to 141[.]164[.]46[.]77.  We observed that this tool was dropped by the side-loaded DLL TosBtKbd.dll<\/i>.<\/b><\/p>\n

<\/span><\/h2>\n

We observed the group leveraging the IOX<\/a> proxy by creating local accounts and setting the LocalAccountTokenFilterPolicy<\/i> value to 1. This configuration grants full administrative privileges to remote connections from all local administrators (and not just the built-in RID 500 account), enabling lateral movement via Pass-the-Hash.<\/p>\n

<\/span><\/h2>\n

Beyond IOX, we observed SHADOW-EARTH-053 deploying multiple tunneling tools within a single environment, suggesting a layered approach to maintaining covert communication channels. These include:<\/p>\n