SHADOW-EARTH-053

☆ pin

Also known as Shadow-Earth-053

Reports

First seen

Apr 30, 2026

Last seen

Sep 3, 2026

Motivation

Espionage

Relationships

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Targeting

Sectors

Government ×1

Top ATT&CK techniques

T1190 Exploit Public-Facing Application ×3T1003 OS Credential Dumping ×2T1041 Exfiltration Over C2 Channel ×2T1505.003 Web Shell ×2T1027 Obfuscated Files or Information ×1T1486 Data Encrypted for Impact ×1T1105 Ingress Tool Transfer ×1T1082 System Information Discovery ×1T1078 Valid Accounts ×1T1071.001 Application Layer Protocol: Web Protocols ×1T1204 User Execution ×1T1566 Phishing ×1

Indicators

filename ×37cve ×15hash_sha256 ×4domain ×2ip_v4 ×2registry_key ×1

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2021-26855 (exploited)CVE-2021-26857 (exploited)CVE-2021-26858 (exploited)CVE-2021-27065 (exploited)CVE-2023-27532 (exploited)CVE-2024-4345 (exploited)CVE-2025-55182 (exploited)CVE-2025-68947 (exploited)CVE-2026-0300 (exploited)CVE-2026-20131 (exploited)CVE-2026-33825 CVE-2026-35616 (exploited)CVE-2026-43284 (exploited)CVE-2026-45585 (exploited)

Recent reports

High