Trend Micro researchers Daniel Lunghi and Lucas Silva published analysis this week on a previously undocumented China-aligned threat cluster they track as SHADOW-EARTH-053. The group has been active since at least December 2024 and has been conducting targeted espionage operations against government agencies and defense sector organizations across South Asia, East Asia, and Southeast Asia, as well as one European government that is a member of NATO. The initial access method is straightforward and consistent. SHADOW-EARTH-053 exploits known N-day vulnerabilities in internet-facing Microsoft Exchange and Internet Information Services servers, specifically the ProxyLogon chain, which has been public since 2021 but continues to work against unpatched deployments. Once inside, the group deploys Godzilla, a server-side web shell with extensive functionality for command execution, file management, and lateral movement, as a persistence mechanism. The distinguishing feature of the campaign is the staging of ShadowPad, a sophisticated modular backdoor with extensive intelligence-collection capabilities, through DLL sideloading of legitimate signed executables. By loading the malicious DLL through a trusted, signed application, the group ensures that their persistence mechanism appears as a legitimate process to endpoint detection tools that rely on process and signature validation. Trend Micro assessed SHADOW-EARTH-053 as sharing some infrastructure and tooling overlap with CL-STA-0049, Earth Alux, and REF7707, suggesting a broader China-nexus operational cluster rather than a fully independent group.

Microsoft SharePoint Server CVE-2026-32201, patched in April Patch Tuesday, has been confirmed as actively exploited for remote code execution this week. The vulnerability allows an attacker with network access to execute arbitrary code on the SharePoint server. Microsoft's original advisory did not flag the vulnerability as exploited at time of patch release, but updated the advisory this week to confirm active exploitation. SharePoint Server is widely deployed in enterprise environments for document management, intranet portals, and collaboration, and frequently has sensitive internal documents and data accessible to authenticated users. Unpatched instances with internet exposure represent a direct entry point into internal networks.

Itron, a global provider of smart metering systems and grid management technology serving electric, gas, and water utilities worldwide, confirmed a cybersecurity incident affecting its corporate IT systems this week. Itron serves over 8,000 utilities and cities across more than 100 countries and provides the metering infrastructure and grid edge intelligence that underpins utility billing, demand response, and grid operations for a significant share of Western energy infrastructure. The company confirmed the breach was contained to corporate IT systems and stated that operational technology and customer-facing metering networks were not impacted at this time. The investigation is ongoing. No threat actor has publicly claimed responsibility and no data has appeared on known leak sites as of today.