Forensia CTI Core

Summary

Ingested excerpt (first ~500 chars of normalized text).

Inside Shadow-Earth-053: A China-Aligned Cyberespionage Campaign Against Government and Defense Sectors in Asia A China-aligned threat group is exploiting unpatched Microsoft Exchange vulnerabilities to conduct cyberespionage against government and critical infrastructure targets across Asia and beyond. Inside Shadow-Earth-053: A China-Aligned Cyberespionage Campaign Against Government and Defense Sectors in Asia | Trend Micro (US) search close About Mission and Culture Mis…

https://www.trendmicro.com/en_us/research/26/d/inside-shadow-earth-053.html

sha256:285473b34959d9cb8bfaabb2e1380b65140adba0ec74b12ecb8c1a7721a30e94

What we pulled out

Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).

cve6
md50
url0
ipv44
ipv60
sha10
domain52
sha2564
malware_token0
attack_pattern0
threat_actor_token1

Indicators

Linked with report → mentions → indicator. Values open the indicator workspace.

Type	Value	Link
domain	cmd.exe	Open →
domain	powershell.exe	Open →
domain	wt.exe	Open →
domain	rundll32.exe	Open →
domain	net.exe	Open →
domain	whoami.exe	Open →
domain	explorer.exe

Malware families

Allowlist token matches only.

None extracted.

Threat actors mentioned

Allowlist mentions — not a formal attribution verdict.

APT41

ATT&CK techniques

MITRE IDs referenced in text and present in local technique table.

None linked (import ATT&CK or adjust text).

CONTINUE INVESTIGATION

High-signal pivots without leaving the thread you started in search.

All reports
Browse the report corpus.
Intel graph (first IOC)
Neighborhood from the first linked indicator.

← Back to reports