Loading story…
Investigations by Trend Micro and Orange Cyberdefense found that intrusions involving the ShadowPad and PlugX backdoors culminated in deployment of NailaoLocker ransomware against organizations in Europe. Trend Micro reported that attackers used WmiExec from the Impacket toolkit for remote access and likely copied Active Directory database contents into files named aaaa.dit for offline password cracking, indicating an effort to expand privileges and move laterally before ransomware execution.
Researchers linked the activity to ShadowPad command-and-control infrastructure including updata.dsqurey[.]com, then pivoted to additional related domains and IP addresses. Attribution remains unresolved: Trend Micro said there are only weak ties to the TeleBoyi threat actor, based on overlaps with a historical PlugX sample, shared dsqurey[.]com infrastructure, and similarities in string decryption routines and PE icons, but the report said the timing of domain re-registration and long gaps in resolution history prevent a confident actor link.
TTPs, infrastructure, and targeting history in one profile.
8 events from the most recent confirmed update back to the earliest known activity.
In January 2024, the IP address 108.61.163[.]91 resolved to dscriy.chtq[.]net, which investigators linked to the threat actor in this case. This later resolution was compared with the 2022 Operation Harvest overlap.
After expiring in late March 2022, dsqurey[.]com was registered again on 2022-06-23. Investigators said they could not determine whether the same actor re-registered it, weakening attribution confidence.
In May 2022, the IP address 108.61.163[.]91 resolved to sery.brushupdata[.]com, a domain listed in Operation Harvest. Investigators later used this overlap as a weak link to TeleBoyi-associated infrastructure.
The domain dsqurey[.]com, later linked to PlugX and ShadowPad infrastructure discussed in the investigation, was initially registered. This registration became part of later attribution analysis.
The report notes that PlugX has existed since at least 2008 and has been used in multiple targeted attacks, usually by Chinese threat actors. It is described as the predecessor to ShadowPad.
The report concluded there was not enough evidence to confidently attribute the ShadowPad activity to a known threat actor. It identified two low-confidence links to TeleBoyi based on a historical PlugX sample, shared dsqurey[.]com infrastructure, and similarities in string decryption and PE icons.
By pivoting from the observed infrastructure, investigators identified additional related IP addresses and at least three more linked domain names, with some tied to other ShadowPad samples. These overlaps, along with matching TTPs from another blog post, reinforced the view that the infrastructure was connected to the same actor.
Investigators described an intrusion in which ShadowPad malware was used, including WmiExec-based remote access and likely dumping of Active Directory data into files named aaaa.dit for offline password cracking. The activity ultimately led to ransomware deployment, and the command-and-control domain updata.dsqurey[.]com was observed in both incident response cases.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcetrendmicro.com
Open sourceorangecyberdefense.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a cyber-espionage campaign using the **ShadowPad** backdoor against industrial control system operators, telecommunications providers, and government-linked organizations in Pakistan, Afghanistan, Malaysia, and later Argentina-linked victimology. In several intrusions, attackers gained initial access through Microsoft Exchange Server exploitation tied to **`CVE-2021-26855`**, while another cluster used trojanized MSI installers for Pakistan government eOffice software to deliver a malicious **`mscoree.dll`** loader and encrypted payloads under **SYSTEM** privileges. Kaspersky said the activity began around March 2021 and assessed with high confidence that a Chinese-speaking threat actor was responsible, though it stopped short of a definitive link to **HAFNIUM**; Trend Micro likewise found overlaps with previously reported China-linked ShadowPad activity but said attribution remained inconclusive. The intrusions relied on multiple execution and persistence methods, including launching ShadowPad through the legitimate **AppLaunch.exe**, DLL hijacking via **OleView** with **`IVIEWERS.dll`** and **`IVIEWERS.dll.dat`**, and web-shell access consistent with tooling such as **China Chopper**. Post-compromise operations included credential theft, lateral movement, scheduled tasks, **Cobalt Strike**, **PlugX**, **Mimikatz**, **procdump**, **Nextnet** scanning, RAR archiving, and data exfiltration over **BITS**, indicating a sustained effort to harvest sensitive information from strategically important networks.
Aug 14, 2026
Researchers have tied **ShadowPad**, a modular malware platform sold privately rather than shared openly, to multiple high-profile espionage operations and supply-chain compromises. Analysis indicates the backdoor emerged as a successor to `PlugX` and has been used by several China-linked activity clusters, including subgroups associated with **APT41** as well as actors previously linked to **Axiom**. Investigators say ShadowPad’s architecture allows its developer to restrict plugin access per customer, helping multiple espionage teams reuse the same malware while complicating attribution and lowering development costs for operators. ShadowPad has surfaced in several notable intrusions, including the **CCleaner** compromise, where a trojanized installer reached about **2.27 million** users but a second-stage payload was delivered to only **40** selected systems; investigators also found ShadowPad on Piriform machines with decrypted logs showing **keylogging** activity. It was also linked to **Operation ShadowHammer**, in which attackers trojanized **ASUS Live Update** binaries that retained valid ASUSTeK signatures and selectively activated only on devices whose network-adapter `MAC` addresses matched hardcoded target lists before contacting `asushotfix[.]com` for a second stage. Reporting also connects related activity to compromises involving **NetSarang**, corporate networks, and Asian gaming-sector targets, reinforcing ShadowPad’s role as a recurring tool in selective, supply-chain-enabled Chinese espionage.
Aug 15, 2026
Researchers and incident responders have tied **ShadowPad**, a privately sold modular backdoor associated with multiple PRC-linked espionage operations, to both major supply-chain compromises and ongoing targeted intrusions. ShadowPad has appeared in high-profile cases including **CCleaner**, **NetSarang**, and **ASUS ShadowHammer**, while a separate campaign used a trojanized installer for Pakistan’s government **E-Office** application to sideload a malicious `mscoree.dll` loader and deploy an encrypted ShadowPad payload. Trend Micro observed victims in Pakistan spanning a government entity, a public sector bank, and a telecommunications provider, with follow-on activity including credential theft via Mimikatz and data exfiltration over PowerShell BITS. ShadowPad was also among the malware families deployed after mass exploitation of Microsoft Exchange zero-days, underscoring its role as a reusable espionage platform across both opportunistic and highly selective operations. Defenders have responded by reverse engineering ShadowPad’s custom TCP, HTTP(S), and UDP command-and-control protocols and using protocol emulation to scan the Internet for live servers that would evade reputation-based detection. VMware and Virus Bulletin research identified dozens of active ShadowPad C2 nodes—roughly **72 to 83 servers** across overlapping study periods—and found that some accepted multiple protocols on the same port and overlapped with infrastructure used by **Spyder** and **ReverseWindow**. One previously identified ShadowPad C2 IP later surfaced in a real incident response case, showing that proactive C2 discovery can expose stealthy intrusions before conventional indicators trigger. Researchers caution that ShadowPad’s commercial, shared-use model complicates attribution, making infrastructure correlation and long-term tracking more reliable than assuming any single actor is responsible.
Aug 15, 2026