A newly uncovered cyber espionage campaign tied to China is raising alarms across the global security community. Researchers from Trend Micro have identified a sophisticated and persistent hacking network that has quietly infiltrated government systems, defense contractors, journalists, and activists across Asia and even into Europe. The campaign highlights not only the growing scale of cyber warfare but also the increasing coordination and ambition of China-aligned digital operations.

Trend Micro is a global cybersecurity firm known for tracking advanced persistent threats and uncovering large-scale hacking operations. Its researchers, including Daniel Lunghi and Lucas Silva, have been closely analyzing a new threat cluster they call SHADOW-EARTH-053. This designation reflects an evolving and not yet fully attributed group, but one that clearly aligns with broader Chinese strategic interests.

According to their findings, this group has been active since at least December 2024 and has already penetrated critical networks in multiple countries. The researchers emphasize that the campaign is not isolated, but part of a broader ecosystem of related hacking groups with overlapping tools, techniques, and infrastructure.

A New Chinese Hacker Network Emerges

The group identified by Trend Micro, SHADOW-EARTH-053, represents a new node in what appears to be a distributed network of China-aligned cyber actors. It shares characteristics with other known intrusion sets such as CL-STA-0049, Earth Alux, and REF7707, though it operates with its own distinct patterns.

What makes this group particularly concerning is its overlap with another cluster known as SHADOW-EARTH-054. Nearly half of the victims targeted by SHADOW-EARTH-053 had already been compromised by this related group. While there is no clear evidence of direct coordination, the reuse of identical tools and vulnerabilities suggests a shared playbook or even shared resources.

Researchers describe this as a form of “independent exploitation,” where multiple groups leverage the same weaknesses and infrastructure without necessarily working together directly.

Where the Hackers Are Operating

The campaign has a strong geographic focus on Asia, targeting countries including Pakistan, Thailand, Malaysia, India, Myanmar, Sri Lanka, and Taiwan. However, its reach extends beyond the region. One notable target is Poland, a NATO member, which underscores the global implications of the operation.

This geographic spread suggests a strategic focus on countries with geopolitical importance to China, particularly those aligned with Western interests or involved in regional security dynamics.

Attribution in cyber operations is notoriously difficult, but several key indicators point toward Chinese involvement. The use of specific malware such as ShadowPad, which has long been associated with China-aligned groups, is one major clue. The targeting patterns also align closely with Chinese geopolitical priorities, including surveillance of governments, defense sectors, and activists critical of Beijing.

Citizen Lab researchers further reinforce this conclusion. They note that the targets of related phishing campaigns “align with the intelligence priorities of the Chinese government,” and suggest “with a medium level of confidence that commercial entities hired by the Chinese state may have been behind both clusters of activity described here.”

Additionally, the tools and infrastructure used in these attacks show strong continuity with previous Chinese cyber operations.

How the Attacks Work

The attack chain used by SHADOW-EARTH-053 is both methodical and effective. It begins with exploiting known vulnerabilities in widely used systems, particularly Microsoft Exchange servers and Internet Information Services. These are often older flaws that remain unpatched in many organizations.

Once inside, the attackers deploy web shells such as Godzilla to maintain persistent access. These act as remote control panels, allowing the hackers to execute commands and explore the network.

From there, the operation escalates. The group conducts reconnaissance, mapping out internal systems and identifying valuable targets. They use tools like Mimikatz to extract credentials and gain higher privileges. They move laterally through networks using remote desktop tools and custom scripts, spreading their access across multiple systems.

Finally, they deploy advanced malware such as ShadowPad, a modular backdoor that allows long-term control and data exfiltration. In some cases, they also use Linux-based malware like Noodle RAT, expanding their reach beyond Windows environments.

What They Are After

The primary objective appears to be cyber espionage. The attackers are targeting sensitive information, including government communications, defense data, and intellectual property. In one instance, they extracted email archives from high-level executives, packaging them into encrypted files for exfiltration.

There are also signs of broader ambitions. According to Trend Micro, the activity “is likely aimed at cyberespionage and intellectual property theft,” but some experts believe it could go further.

Tom Kellermann, a senior security researcher, warned that the group may be preparing for future disruptive actions. “I’m concerned about what they are leaving behind,” he said. “What type of C2 on a sleep cycle is still lingering in these environments? Whether or not they have already prepositioned wipers or destructive capabilities.”

This raises the possibility that the hackers are not just gathering information but positioning themselves for potential sabotage.

Targeting Journalists and Activists

In parallel with these network intrusions, other China-linked groups known as GLITTER CARP and SEQUIN CARP have been conducting phishing campaigns against journalists and activists. These campaigns focus on individuals connected to sensitive topics, including Uyghur, Tibetan, Taiwanese, and Hong Kong issues.

The attackers use sophisticated impersonation tactics, posing as trusted contacts or technology companies. They aim to trick targets into revealing login credentials or granting access through OAuth tokens.

Citizen Lab noted that these operations rely on “well-thought-out digital impersonation schemes,” often reusing infrastructure across multiple campaigns. This suggests a coordinated and scalable approach to surveillance and influence.

Security experts are increasingly vocal about the implications of these findings. Kellermann compared the new group to earlier Chinese campaigns like Volt Typhoon and Salt Typhoon, which were known for long-term infiltration of critical infrastructure.

“They’re following in the footsteps of the Typhoon campaigns,” he said. “They look like the younger brother and sister of the Typhoon campaigns, and they’re island-hopping through the defense sectors and ministries of those nations for a reason.”

He also warned that targeting a NATO country like Poland signals a broader escalation. “This is the direct prepositioning of these assets to colonize these infrastructures for the purpose of not just espionage, but long term sabotage, if need be.”

A Growing Cyber Threat

The discovery of SHADOW-EARTH-053 and its related networks underscores a troubling trend. Cyber operations are becoming more persistent, more distributed, and more closely aligned with national strategy.

These hackers are not simply breaking into systems and leaving. They are embedding themselves, learning the terrain, and potentially preparing for future conflicts that may extend beyond the digital realm.

For governments and organizations worldwide, the message is clear. The threat is not hypothetical. It is already inside critical systems, quietly waiting.