ShadowPadMalware
- poisonplug.shadow
- xshellghost
ShadowPad is a modular backdoor that was first identified in a supply chain compromise of the NetSarang software in mid-July 2017. The malware was originally thought to be exclusively used by APT41, but has since been observed to be used by various Chinese threat activity groups.From MITRE ATT&CK
Last reported 3 months ago, by SentinelLabs6 reports
ATT&CK techniques
6 of 59 · each with the sentence it comes from- T1053.005Scheduled Task
“T1053.005”
- T1007System Service Discovery
“T1007”
- T1008Fallback Channels
“T1008”
- T1010Application Window Discovery
“T1010”
- T1014Rootkit
“T1014”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Dynamic API Resolution”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
6 reports, newest first · the exact sentence from each-
One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law Enforcement“Our analysis of C2 netflow data revealed that suspected China- and India-nexus threat actors operating PlugX, ShadowPad, Cobalt Strike, and Remcos infrastructure have converged on this victim class.”
-
Arsenal de FishMonger actualizado: SprySOCKS para Windows“El toolset de FishMonger incluye ShadowPad, Spyder, Cobalt Strike, FunnySwitch, SprySOCKS y el BIOPASS RAT.”
-
FishMonger’s arsenal upgraded: SprySOCKS for Windows“FishMonger’s toolset includes ShadowPad, Spyder, Cobalt Strike, FunnySwitch, SprySOCKS, and the BIOPASS RAT.”
-
China's State-Sponsored Cyber Operations & Ecosystem“Patriotic hackers professionalised after 2002 and contributed to payloads like PlugX and ShadowPad under Military-Civil Fusion.”
-
Inside Shadow-Earth-053: A China-Aligned Cyberespionage Campaign Against Government and Defense Sectors in Asia“…ernet Information Services (IIS) servers (e.g., ProxyLogon chain), then deploys web shells (GODZILLA) for persistent access and stages ShadowPad implants via DLL sideloading of legitimate signed executables.”
-
The Rise of Collaborative Tactics Among China-aligned Cyber Espionage Campaigns“Deployment of ShadowPad via Multiple Vectors (March 2025)”
Indicators in its reports
named in the reports above- ffc3aa7909d4e72c…60dffe5c99b7in 2 reports
- 207.148.78[.]36in 2 reports
- 207.148.75[.]122in 2 reports
- 955bfc3dcc867256…0779fa3416d8in 2 reports
- 44dc4a08c5eb0972…4e06f09006bbin 2 reports
- ab87b29b6f79487c…9001e536f083in 2 reports
- 6490b8e4aade25a3…2db2122470bcin 2 reports
- e7484c24b88a1a24…9a993670285bin 2 reports
- 621d1952839be4b0…e5062ca368edin 2 reports
- 2457eed2ab28e377…9dad2c8079d4in 2 reports
- d2c706b1eaf662bf…73ed84bda24ain 2 reports
Copy these 11 indicators · defanged
Thanks — we review every report.