ShadowPad

ShadowPad is a sophisticated malware, known for its modular backdoor capabilities, that has been popular among Chinese threat actors for over seven years. It is designed to infiltrate systems often through suspicious downloads, emails, or websites, and once inside, it can steal personal information, disrupt operations, or even hold data hostage for ransom. ShadowPad was notably used as the payload in a supply chain attack targeting the South Asian government, as revealed in a VB2023 paper. The malware leverages legitimate utilities to load DLLs from itself and PlugX, another notorious malware. Furthermore, it has evolved over time with Snappybee (Deed RAT), considered its successor, employing DLL sideloading as its primary execution method. A connection was observed between ShadowPad and the Stately Taurus activity cluster, particularly through the use of Listener.bat. This file, along with other malware including ShadowPad, originated from the same network session, indicating a potential link between the two. In addition, ShadowPad infection was detected in Cortex XDR, further demonstrating its pervasive nature. The malware's command and control (C&C) server was identified as being part of the Tonto Team at lab.symantecsafe[.]org, illustrating the organized nature of these cyber threats. The continued use and evolution of ShadowPad highlight the persistent threat landscape organizations face today. Cybersecurity measures need to be continuously updated and fortified to counter such threats. The discovery of ShadowPad Service Names on 216.83.40[.]84 and the identification of the ShadowPad Cluster Attacker C2 indicate ongoing efforts to understand and neutralize this threat. As the connections between different threat clusters like ShadowPad and Stately Taurus become clearer, this knowledge will be instrumental in developing more robust defenses against these evolving cyber threats.