ShadowPad

ShadowPad is a modular malware that has been utilized by various Chinese threat actors since at least 2017. It's a malicious software designed to infiltrate computer systems, often without the user's knowledge, and can cause significant damage by stealing personal information, disrupting operations, or holding data for ransom. ShadowPad is typically delivered through suspicious downloads, emails, or websites, and once inside a system, it can deploy other harmful activities. This malware was notably used as the payload in a supply chain attack targeting South Asian governments, according to a VB2023 paper. The ShadowPad malware has been observed to have connections with other cyber threats. For instance, it was found that Winnti uses legitimate utilities to load DLLs from ShadowPad and PlugX. Furthermore, an examination of the Stately Taurus activity cluster revealed a connection with another cluster that used the ShadowPad backdoor in the same environment. The origins of Listeners.bat, a tool used in the Stately Taurus cluster, were traced back to the same network session that wrote additional files and malware, including the ShadowPad backdoor, indicating a potential link between the ShadowPad activity and the VSCode activity associated with Stately Taurus. ShadowPad's command-and-control (C2) servers have been identified, such as the one operated by the Tonto Team at lab.symantecsafe[.]org and another one with the IP address 216.83.40[.]84. These servers are crucial for the operation of the malware, allowing remote control over infected systems. In addition, ShadowPad infections have been detected in Cortex XDR, highlighting the broad reach of this malware. As one of the main tools used in these activity clusters, ShadowPad represents a significant threat to cybersecurity worldwide.