shadowpad

ShadowPad is a China-linked intrusion cluster and malware ecosystem associated with advanced espionage operations, particularly against government organizations in Asia. Activity attributed to ShadowPad has been observed across multi-stage intrusion chains centered on DLL sideloading, abuse of legitimate signed applications, encrypted plugin-based payload delivery, and modular post-compromise tooling. The name is also used for the malware platform itself, and reporting has linked related activity to the alias NetSarang in some cases. Observed operations used a consistent sideloading tradecraft pattern involving legitimate executables paired with malicious DLLs, followed by decryption and loading of additional implants and configuration data. Related intrusions have included service-based persistence, autorun persistence, UAC bypass, process injection, process hollowing, and anti-security actions. Shared loader shellcode and recurring obfuscation patterns across multiple campaigns indicate a long-running toolset lineage or shared development ecosystem. Researchers have also linked later activity to earlier sideloading sets dating back several years. Targets documented at high confidence include government entities in Asia. More recent reporting also associates ShadowPad activity with exploitation of a WSUS remote code execution vulnerability, using the access to deploy ShadowPad malware and establish persistence on compromised systems. Across reporting, the actor or ecosystem is characterized by stealthy post-exploitation, defense evasion, and modular malware loading rather than overt disruption or extortion. The available evidence supports an espionage-oriented, suspected Chinese APT attribution.