China-Linked Cyber Campaign Targets Asian Governments and Dissidents

Cybersecurity researchers at Trend Micro have disclosed a sophisticated China-aligned espionage campaign, tracked as Shadow-Earth-053, active since December 2024. This operation features a dual focus: traditional intelligence collection against government and defense networks in Asia, and targeted surveillance of overseas critics. The campaign has infiltrated ministries and contractors in Pakistan, Thailand, Malaysia, India, Myanmar, Sri Lanka, Taiwan, and Poland. Simultaneously, linked clusters known as Glitter Carp and Sequin Carp used phishing techniques to target Uyghur, Tibetan, Taiwanese, and Hong Kong activists, along with journalists. Attackers exploited unpatched Microsoft Exchange servers and zero-day vulnerabilities to install backdoors and malware. The disclosure coincides with reports that China’s offensive cyber capabilities have reached parity with the United States, reflecting President Xi Jinping’s strategic priority of becoming a cyber superpower. Recent military reorganizations, including the establishment of a dedicated Cyberspace Force in 2024, have centralized command and accelerated the deployment of modular malware toolkits. This development underscores China’s growing proficiency in blending state espionage with transnational repression, supported by increased defense spending and structural reforms within the People’s Liberation Army.