Loading story…
Researchers detailed how ShadowPad, a modular remote access trojan active since at least 2017, has been used by the Chinese threat group BRONZE ATLAS—also tracked as APT41, Axiom, Winnti, and Wicked Panda—and later adopted by multiple other Chinese espionage clusters. Secureworks and Sophos said the malware is commonly deployed through DLL sideloading and DLL search order hijacking with legitimate executables, using two-file and three-file execution chains, in-memory payload decryption, persistence through Windows services and registry keys, and process injection into child processes. The reporting links separate ShadowPad activity clusters to actors aligned with China’s Ministry of State Security and to PLA-affiliated groups whose targeting maps to Northern, Southern, and Western Theater Command regions.
TTPs, infrastructure, and targeting history in one profile.
9 events from the most recent confirmed update back to the earliest known activity.
Infosecurity Magazine reported that threat actors associated with the ShadowPad malware targeted government entities in Asia. This added a new campaign development showing continued operational use of ShadowPad against regional government victims beyond the earlier supply-chain cases.
PolySwarm published a profile of Wicked Panda summarizing prior research that tied the group and related Chinese clusters to ShadowPad operations and PLA theater-command-aligned activity. The article consolidated attribution and tradecraft details rather than disclosing a new incident.
Secureworks CTU published an analysis describing ShadowPad's DLL sideloading execution chains, in-memory decryption, persistence mechanisms, process injection, and indicators of compromise. The report also assessed links between ShadowPad activity clusters and MSS- and PLA-affiliated Chinese groups.
Positive Technologies reported that it discovered the previously unknown xDll backdoor in March 2020 and, via an exposed C2 server, uncovered ShadowPad, a Python backdoor, and attacker tools tied to Winnti/APT41 infrastructure active since early 2019. The researchers observed more than 50 infected systems and over 150 related IPs across victims in the United States, Netherlands, Russia, China, and Germany, warning the activity could support another supply-chain attack.
The references note that in 2020 several affiliates associated with Wicked Panda/APT41 were charged for computer intrusion campaigns affecting more than 100 victims worldwide. The legal action is cited as part of the broader public attribution history around actors tied to ShadowPad use.
Research cited in the references states that ShadowPad was involved in major 2017 supply-chain attacks affecting CCleaner and ASUS Live Update in addition to NetSarang. These incidents broadened understanding of the malware's role in high-impact software supply-chain compromises.
Kaspersky disclosed that attackers had embedded the ShadowPad backdoor in NetSarang software used by large companies worldwide, marking one of the earliest major public incidents involving the malware. The disclosure established ShadowPad as a significant supply-chain threat.
Secureworks research says the Chinese state-sponsored BRONZE ATLAS group has used the modular ShadowPad remote access trojan since at least 2017. This marks the earliest stated operational use of ShadowPad by that cluster in the provided references.
According to Secureworks, ShadowPad use expanded from around 2019 onward to multiple Chinese threat groups operating globally. The report links separate activity clusters to MSS-affiliated and PLA-affiliated actors.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 52 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
9 references tracked. Mallory keeps watching after this page renders.
blog.polyswarm.io
Open sourcesophos.com
Open sourcesophos.com
Open sourcesecureworks.com
Open sourceinfosecurity-magazine.com
Open sourcethehackernews.com
Open sourcepwc.co.uk
Open sourceweb.archive.org
Open sourcekaspersky.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers have tied **ShadowPad**, a modular malware platform sold privately rather than shared openly, to multiple high-profile espionage operations and supply-chain compromises. Analysis indicates the backdoor emerged as a successor to `PlugX` and has been used by several China-linked activity clusters, including subgroups associated with **APT41** as well as actors previously linked to **Axiom**. Investigators say ShadowPad’s architecture allows its developer to restrict plugin access per customer, helping multiple espionage teams reuse the same malware while complicating attribution and lowering development costs for operators. ShadowPad has surfaced in several notable intrusions, including the **CCleaner** compromise, where a trojanized installer reached about **2.27 million** users but a second-stage payload was delivered to only **40** selected systems; investigators also found ShadowPad on Piriform machines with decrypted logs showing **keylogging** activity. It was also linked to **Operation ShadowHammer**, in which attackers trojanized **ASUS Live Update** binaries that retained valid ASUSTeK signatures and selectively activated only on devices whose network-adapter `MAC` addresses matched hardcoded target lists before contacting `asushotfix[.]com` for a second stage. Reporting also connects related activity to compromises involving **NetSarang**, corporate networks, and Asian gaming-sector targets, reinforcing ShadowPad’s role as a recurring tool in selective, supply-chain-enabled Chinese espionage.
Aug 15, 2026
Researchers and incident responders have tied **ShadowPad**, a privately sold modular backdoor associated with multiple PRC-linked espionage operations, to both major supply-chain compromises and ongoing targeted intrusions. ShadowPad has appeared in high-profile cases including **CCleaner**, **NetSarang**, and **ASUS ShadowHammer**, while a separate campaign used a trojanized installer for Pakistan’s government **E-Office** application to sideload a malicious `mscoree.dll` loader and deploy an encrypted ShadowPad payload. Trend Micro observed victims in Pakistan spanning a government entity, a public sector bank, and a telecommunications provider, with follow-on activity including credential theft via Mimikatz and data exfiltration over PowerShell BITS. ShadowPad was also among the malware families deployed after mass exploitation of Microsoft Exchange zero-days, underscoring its role as a reusable espionage platform across both opportunistic and highly selective operations. Defenders have responded by reverse engineering ShadowPad’s custom TCP, HTTP(S), and UDP command-and-control protocols and using protocol emulation to scan the Internet for live servers that would evade reputation-based detection. VMware and Virus Bulletin research identified dozens of active ShadowPad C2 nodes—roughly **72 to 83 servers** across overlapping study periods—and found that some accepted multiple protocols on the same port and overlapped with infrastructure used by **Spyder** and **ReverseWindow**. One previously identified ShadowPad C2 IP later surfaced in a real incident response case, showing that proactive C2 discovery can expose stealthy intrusions before conventional indicators trigger. Researchers caution that ShadowPad’s commercial, shared-use model complicates attribution, making infrastructure correlation and long-term tracking more reliable than assuming any single actor is responsible.
Aug 15, 2026
Researchers reported a cyber-espionage campaign using the **ShadowPad** backdoor against industrial control system operators, telecommunications providers, and government-linked organizations in Pakistan, Afghanistan, Malaysia, and later Argentina-linked victimology. In several intrusions, attackers gained initial access through Microsoft Exchange Server exploitation tied to **`CVE-2021-26855`**, while another cluster used trojanized MSI installers for Pakistan government eOffice software to deliver a malicious **`mscoree.dll`** loader and encrypted payloads under **SYSTEM** privileges. Kaspersky said the activity began around March 2021 and assessed with high confidence that a Chinese-speaking threat actor was responsible, though it stopped short of a definitive link to **HAFNIUM**; Trend Micro likewise found overlaps with previously reported China-linked ShadowPad activity but said attribution remained inconclusive. The intrusions relied on multiple execution and persistence methods, including launching ShadowPad through the legitimate **AppLaunch.exe**, DLL hijacking via **OleView** with **`IVIEWERS.dll`** and **`IVIEWERS.dll.dat`**, and web-shell access consistent with tooling such as **China Chopper**. Post-compromise operations included credential theft, lateral movement, scheduled tasks, **Cobalt Strike**, **PlugX**, **Mimikatz**, **procdump**, **Nextnet** scanning, RAR archiving, and data exfiltration over **BITS**, indicating a sustained effort to harvest sensitive information from strategically important networks.
Aug 14, 2026