Loading malware…
ShadowPad is a modular Windows backdoor used by multiple China-linked espionage groups, including APT41 and Tonto Team. Publicly identified during the 2017 NetSarang software supply-chain compromise, it is privately distributed among threat actors rather than exclusive to a single group. Victims span government, telecommunications, manufacturing, finance, research, software development, and other industries worldwide.
Its plugin-based architecture supports remote command execution, system reconnaissance, keylogging, screenshot capture, file retrieval, data exfiltration, and additional module loading. ShadowPad decrypts and loads components into memory and can inject its installation module or other payloads into legitimate processes. Deployments commonly use DLL sideloading through signed applications. Persistence mechanisms include Windows services, scheduled tasks, and registry autorun entries. Some variants store encrypted plugins, configurations, or payloads in a registry-backed virtual file system, with machine-specific encryption complicating payload recovery. Additional evasion mechanisms include encrypted imports, custom executable loading, obfuscation, and anti-debugging checks; an analyzed variant also supports a UAC-bypass execution mode.
ShadowPad supports multiple command-and-control transports, including TCP, UDP, HTTP, HTTPS, and DNS, with DNS tunneling and DNS over HTTPS observed in deployments. Infection routes include compromised software distributions, post-exploitation deployment following Microsoft Exchange and WSUS compromises, and spearphishing-linked browser exploit chains. Attackers also install it after gaining access through compromised VPN accounts. ShadowPad enables persistent surveillance and post-compromise operations, but its presence alone does not establish attribution to a particular Chinese threat group.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
14 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
AhnLab reported that attackers exploited CVE-2025-59287 for initial Access, then used certutil and curl to download and install ShadowPad. | “AhnLab reported that attackers exploited CVE-2025-59287 for initial Access, then used certutil and curl to download and install ShadowPad.”
NetSarang Xmanager Enterprise 5.0 Build 1232, Xmanager 5.0 Build 1045, Xshell 5.0 Build 1322, Xftp 5.0 Build 1218, and Xlpd 5.0 Build 1220 contain a malicious nssock2.dll that implements a multi-stage, DNS-based backdoor.
Microsoft was spurred to release out-of-band patches for the exploited bugs, known collectively as ProxyLogon, which are being tracked as CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065.
Microsoft was spurred to release out-of-band patches for the exploited bugs, known collectively as ProxyLogon, which are being tracked as CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065.
Microsoft was spurred to release out-of-band patches for the exploited bugs, known collectively as ProxyLogon, which are being tracked as CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065.
Microsoft was spurred to release out-of-band patches for the exploited bugs, known collectively as ProxyLogon, which are being tracked as CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065.
A sophisticated cyberattack campaign, identified in November 2025, leverages a critical vulnerability in Microsoft Windows Server Update Services (WSUS) to deploy ShadowPad, a highly modular backdoor malware used extensively by Chinese state-sponsored APT groups for espionage operations.
The first exploit targets CVE-2026-85046 in V8's optimizing compilers. When an array's element type changes during sorting, the optimized code can treat a value as the wrong type.
That DLL checks the Windows build again, then tries CVE-2026-85880. The exploit uses the ALPC communication and WNF notification mechanisms to gain kernel read/write access.
The next exploit, CVE-2026-87491, escapes the V8 sandbox. BlueMoon corrupts WebAssembly metadata and replaces compiled function code with the p1 shellcode.
In 2020, they exploited CVE-2019-9489 and CVE-2020-8468 in Trend Micro’s security solutions that were exposed to the Internet, in order to deliver ShadowPad into internal networks for further exploitation. | ShadowPad is a privately sold modular malware platform –rather than an open attack framework– with plugins sold separately.
In 2020, they exploited CVE-2019-9489 and CVE-2020-8468 in Trend Micro’s security solutions that were exposed to the Internet, in order to deliver ShadowPad into internal networks for further exploitation. | ShadowPad is a privately sold modular malware platform –rather than an open attack framework– with plugins sold separately.
Ivanti Connect Secure Authentication Bypass [CVE-2023-46805] ... Allows unauthenticated attackers to bypass authentication controls. Commonly exploited in conjunction with CVE-2024-21887, enabling remote command execution and full system compromise. Trend Micro’s report on Earth Estries/Salt Typhoon states that the group actively exploits Ivanti Connect Secure VPN flaws to establish initial access ... | The frpc C&C 165.154.227[.]192 could be linked to an SSL certificate ... previously used by ShadowPad, which is another shared tool among several Chinese APT groups.
CVE-2024-21887: Vulnerability Type: Command Injection ... Allows remote, unauthenticated attackers to execute commands with elevated privileges, potentially leading to full system compromise ... Trend Micro’s report on Earth Estries/Salt Typhoon states that the group actively exploits Ivanti Connect Secure VPN flaws to establish initial access ... | The frpc C&C 165.154.227[.]192 could be linked to an SSL certificate ... previously used by ShadowPad, which is another shared tool among several Chinese APT groups.
25 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
"The attacks resulted in the ShadowPad loader being implanted"; separate unattributed ShadowPad activity affected a software development company and a real estate company.
They stole source code, software code signing certificates, customer account data, personally identifiable information, and deployed sophisticated supply-chain attacks [CCleaner, ShadowPad, ShadowHammer], the indictment reveals.
In UNK_LateNight's campaign, the DLL decrypts A08744D2.tmp with AES and loads ShadowPad, a backdoor that steals Firefox profile data and captures network traffic.
The attackers use well-known malware, such as PlugX, ShadowPad, Poison Ivy.
Both incidents involved Shadowpad, a malware family that has been used by multiple advanced Chinese threat actors to perform espionage.
ShadowPad is a privately sold modular malware platform –rather than an open attack framework– with plugins sold separately.
27 distinct techniques documented for this family, organized by ATT&CK tactic.
ShadowPad communicates over HTTP/HTTPS to C2 servers using spoofed browser headers to blend with legitimate traffic.
Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
497 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Privately shared modular Windows espionage backdoor described as a successor to PlugX. Uses obfuscation, DLL sideloading, and in-memory components. Delivery has included supply-chain compromise and exploitation of the WSUS vulnerability CVE-2025-59287. The article dates its first appearance to 2015 and wider recognition to a 2017 software compromise.
Named malware delivered through BlueMoon in espionage-focused campaigns. The content does not describe its specific functionality.
A backdoor delivered through BlueMoon in UNK_LateNight's campaign using DLL sideloading and an AES-encrypted payload. It steals Firefox profile data, captures network traffic, and communicates over HTTPS. The campaign's infection chain uses the EdgeCore_AutoUpdate scheduled task for persistence.
Remote-access trojan/backdoor reportedly deployed on Piriform workstations and a build server during the intrusion preceding the CCleaner supply-chain compromise.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.