Inside Shadow-Earth-053: A China-Aligned Cyberespionage Campaign Against Government and Defense Sectors in Asia

Table 1. Legitimate executables vulnerable to DLL sideloading abused by SHADOW‑EARTH‑053 SHADOW-EARTH-053 uses a legitimate Toshiba Bluetooth Stack executable, renamed to CIATosBtKbd.exe, to sideload a malicious DLL (TosBtKbd.dll). This loader employs a multistage evasion technique by retrieving its payload from the Windows Registry rather than embedding it within the binary. Upon execution, the loader calls GetComputerNameA to identify the host and access a machine-specific registry key at

HKEY_CURRENT_USER\Software\[ComputerName]. From…