ShadowPad

Malware updated a month ago (2024-11-29T14:31:53.866Z)

Download STIX

Preview STIX

ShadowPad is a sophisticated malware, known for its use in supply chain attacks, particularly against government entities in South Asia. This modular backdoor, which has been active for approximately seven years, is popular among Chinese threat actors. It was notably used as the payload in an attack targeting the South Asian government, delivered through legitimate utilities like DLL sideloading by the Winnti group. The malware's functionality extends to loading DLLs from ShadowPad and PlugX, as well as establishing connections with other malicious components such as Listener.bat of Stately Taurus. This malware has been associated with various cybercriminal groups and their activities. For instance, traces were found linking it to the UNC2643 activity, which is connected to the HAFNIUM threat actor. Furthermore, the ShadowPad C&C server was identified within the lab.symantecsafe[.]org Tonto Team. A significant connection was also observed between the Stately Taurus activity cluster and another cluster that utilized the ShadowPad backdoor in the same environment. An infection of ShadowPad was detected in Cortex XDR, indicating its pervasive nature. Snappybee (Deed RAT), revealed by Postiv Technologies, is considered the successor to ShadowPad. Like its predecessor and Zingdoor, Snappybee primarily executes through DLL sideloading. The presence of Cobalt Strike beacons and the origin of two files from the same network session suggest a potential link between ShadowPad activity and the VSCode activity related to Stately Taurus. As ShadowPad continues to evolve and influence cyber threats, understanding its mechanisms and associations is crucial for effective cybersecurity.

Description last updated: 2024-11-28T11:43:39.509Z

What's your take? (Question 1 of 5)

Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.

Possible Aliases / Cluster overlaps

It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at. Create a free account to see the source evidence for each alias, and help fix any errors.

Alias Description	Votes
PlugX is a possible alias for ShadowPad. PlugX is a Remote Access Trojan (RAT) malware known for its stealthy operations and destructive capabilities. It is often used by threat actors to exploit and damage computer systems, steal personal information, disrupt operations, or hold data hostage for ransom. Its deployment has been linked to s	9

Miscellaneous Associations

Other elements of context that could aid in the identification of relevance

Malware

Backdoor

Apt

Espionage

Loader

Trojan

Rat

Payload

Linux

State Sponso...

Encryption

Exploit

Cobalt Strike

Symantec

Tool

Implant

Windows

Chinese

Analyst Notes & Discussion

Be the first to leave your mark here! Log in to share your views and vote.

Associated Malware

To see the evidence that has resulted in these malware associations, create a free account

Alias Description	Association Type	Votes
The malware Poisonplug is associated with ShadowPad.	Unspecified	2

Associated Threat Actors

To see the evidence that has resulted in these threatActor associations, create a free account

Alias Description	Association Type	Votes
The Winnti Threat Actor is associated with ShadowPad. Winnti is a threat actor group known for its malicious activities, primarily originating from Chinese Advanced Persistent Threat (APT) operational infrastructure. The group, which has been active since at least 2007, was first spotted by Kaspersky in 2013. It is associated with several aliases such	Unspecified	7
The APT41 Threat Actor is associated with ShadowPad. APT41, also known as Winnti, is a threat actor suspected to be originating from China, with its activities dating back to as early as 2012. It has targeted organizations in at least 14 countries and has been associated with the use of at least 46 different code families and tools. The group's activi	Unspecified	6
The Redfly Threat Actor is associated with ShadowPad. RedFly, a threat actor group known for its malicious activities, has emerged as a significant cybersecurity concern. The group's operations are characterized by their strategic execution and targeted focus, often resulting in substantial security breaches. Threat actors like RedFly pose a significan	Unspecified	5
The Winnti Group Threat Actor is associated with ShadowPad. The Winnti Group, a threat actor associated with the Chinese state-sponsored hacking activities, has been active since at least 2007, according to researchers from Kaspersky Lab who first identified the group in 2013. The group initially gained notoriety for its attacks on computer game developers a	Unspecified	2
The Bronze University Threat Actor is associated with ShadowPad. Bronze University, also known as Aquatic Panda, ControlX, RedHotel, and Earth Lusca, is a threat actor group believed to be a Chinese state-sponsored hacking operation. The group has been active since 2021, targeting government, aerospace, education, telecommunications, media, and research organizat	Unspecified	2
The Lancefly Threat Actor is associated with ShadowPad. Lancefly, a threat actor potentially associated with China, has been identified as the group behind an ongoing cyberespionage campaign targeting organizations in South and Southeast Asia. The targets include government bodies, aviation companies, educational institutions, and telecommunication secto	Unspecified	2
The Earth Lusca Threat Actor is associated with ShadowPad. Earth Lusca, a threat actor believed to be part of the China-backed Winnti collective, has been active since at least 2019 and is known for its cyber-espionage activities. The group primarily targets government organizations in Asia, Latin America, and other regions. Recently, it has expanded its ar	Unspecified	2
The I-Soon Threat Actor is associated with ShadowPad. i-Soon, also known as Anxun, is a threat actor identified as a private industry contractor for the Chinese Ministry of Public Security (MPS). The company has recently been implicated in a massive data leak that surfaced on Github. As elaborated by Tom Uren and Catalin Cimpanu, i-Soon frequently init	Unspecified	2
The Redhotel Threat Actor is associated with ShadowPad. RedHotel is a prolific threat actor group, known for its espionage activities targeting organizations of interest to the Chinese government. The group has been active since at least 2019 and operates alongside other threat groups such as RedAlpha and Poison Carp. Researchers at Recorded Future have	Unspecified	2

Source Document References

Information about the ShadowPad Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more

Source Link	CreatedAt	Title
Securelist	a month ago	Kaspersky report on APT trends in Q3 2024
Trend Micro	2 months ago	Breaking Down Earth Estries Persistent TTPs in Prolonged Cyber Operations
DARKReading	4 months ago	Microsoft VS Code Undermined in Asian Spy Attack
Unit42	4 months ago	Chinese APT Abuses VSCode to Target Government in Asia
Securityaffairs	5 months ago	Security Affairs newsletter Round 484 by Pierluigi Paganini – INTERNATIONAL EDITION
Securityaffairs	5 months ago	CISA adds Microsoft COM for Windows bug to its Known Exploited Vulnerabilities catalog
Checkpoint	5 months ago	5th August – Threat Intelligence Report - Check Point Research
Securityaffairs	5 months ago	China-linked APT41 breached Taiwanese research institute
DARKReading	5 months ago	China's APT41 Targets Taiwan Research Institute for Cyber Espionage
BankInfoSecurity	6 months ago	Researchers Uncover Chinese Hacking Cyberespionage Campaign
BankInfoSecurity	9 months ago	iSoon Leak Shows Links to Chinese APT Groups
DARKReading	9 months ago	Chinese APT 'Earth Krahang' Compromises 48 Gov't Orgs on 5 Continents
Trend Micro	10 months ago	Earth Krahang Exploits Intergovernmental Trust to Launch Cross-Government Attacks
CERT-EU	10 months ago	Anxun and Chinese APT Activity - ReliaQuest
CERT-EU	10 months ago	i-SOON Data Leak: Key Points
Trend Micro	10 months ago	Earth Lusca Uses Geopolitical Lure to Target Taiwan Before Elections
CERT-EU	10 months ago	A Mysterious Leak Exposed Chinese Hacking Secrets \| #hacking \| #cybersecurity \| #infosec \| #comptia \| #pentest \| #hacker \| National Cyber Security Consulting
Unit42	10 months ago	Data From Chinese Security Services Company i-Soon Linked to Previous Chinese APT Campaigns
CERT-EU	10 months ago	Leaked documents show how firm supports Chinese hacking operations
Securelist	a year ago	Kaspersky malware report for Q3 2023