China-based attackers exploited the ToolShell vulnerability (CVE-2025-53770) to compromise a Middle Eastern telecoms company and government agencies in Africa and South America. The attackers deployed malware such as Zingdoor, ShadowPad, and KrustyLoader, which have been associated with Chinese threat groups like Glowworm and UNC5221. The campaign also targeted government departments, a university, and a finance company across multiple regions. The attackers used various tools and techniques, including DLL sideloading, credential theft, and publicly available utilities. The activity suggests a focus on espionage and establishing persistent access to victim networks.