216.73.217.22

SHADOW-EARTH-053

· Published 04/05/2026 15:59 · Modified 04/05/2026 15:59 · Source: AlienVault

Essential information

Confidence
100/100
Published
04/05/2026 15:59
Modified
04/05/2026 15:59
Updated at
04/05/2026 15:59
Revoked
No
Author / Source
AlienVault
Resource level
—
Primary motivation
—
Related entities
1 reports, 19 attack patterns (mitre), 7 malware, 4 sectors, 9 countries, 63 indicators, 5 vulnerabilities (cve)

Description

No description.

Marking (TLP)

TLP:CLEAR

Related entities

Attack patterns, malware, vulnerabilities, indicators and other entities linked to this intrusion set.

Reports (1)

Attack patterns (MITRE) (19)

Malware (7)

  • VSHELL uses
    Family
    Published 05/05/2026 14:07 · Modified 05/05/2026 14:07
  • GODZILLA uses
    Family
    Published 25/05/2026 08:08 · Modified 25/05/2026 08:08
  • NOODLERAT uses
    Family
    Published 30/04/2026 19:11 · Modified 30/04/2026 19:11
  • IOX uses
    AlienVault Confidence 100
    First seen 01/01/1970 · Last seen 16/11/5138 Published 04/05/2026 15:59 · Modified 04/05/2026 15:59
  • ShadowPad - S0596 uses
    Family
    Published 30/04/2026 19:11 · Modified 30/04/2026 19:11
  • RingQ uses
    Family
    Published 30/04/2026 19:11 · Modified 30/04/2026 19:11
  • POISONPLUG.SHADOW uses
    Family
    Published 30/04/2026 19:11 · Modified 30/04/2026 19:11

Sectors (4)

  • Defense targets
  • Technology targets
  • Transportation targets
  • Government targets

Countries (9)

  • India targets
  • Taiwan targets
  • Myanmar targets
  • British Indian Ocean Territory targets
  • Pakistan targets
  • Poland targets
  • Malaysia targets
  • Sri Lanka targets
  • Thailand targets

Indicators (63)

Vulnerabilities (CVE) (5)

CVE-2021-26857 KEV

Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.

Published
03/11/2021
Modified
21/12/2025
CVE-2025-55182 KEV
10.0 Critical

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, …

Attack vector
Network
Published
05/12/2025
Modified
29/05/2026
Analyzed
CVE-2021-27065 KEV

Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.

Published
03/11/2021
Modified
20/12/2025
CVE-2021-26855 KEV

Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.

Published
03/11/2021
Modified
20/12/2025
CVE-2021-26858 KEV

Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.

Published
03/11/2021
Modified
21/12/2025