Loading story…
Researchers have tied ShadowPad, a modular malware platform sold privately rather than shared openly, to multiple high-profile espionage operations and supply-chain compromises. Analysis indicates the backdoor emerged as a successor to PlugX and has been used by several China-linked activity clusters, including subgroups associated with APT41 as well as actors previously linked to Axiom. Investigators say ShadowPad’s architecture allows its developer to restrict plugin access per customer, helping multiple espionage teams reuse the same malware while complicating attribution and lowering development costs for operators.
ShadowPad has surfaced in several notable intrusions, including the CCleaner compromise, where a trojanized installer reached about 2.27 million users but a second-stage payload was delivered to only 40 selected systems; investigators also found ShadowPad on Piriform machines with decrypted logs showing keylogging activity. It was also linked to Operation ShadowHammer, in which attackers trojanized ASUS Live Update binaries that retained valid ASUSTeK signatures and selectively activated only on devices whose network-adapter MAC addresses matched hardcoded target lists before contacting asushotfix[.]com for a second stage. Reporting also connects related activity to compromises involving NetSarang, corporate networks, and Asian gaming-sector targets, reinforcing ShadowPad’s role as a recurring tool in selective, supply-chain-enabled Chinese espionage.
TTPs, infrastructure, and targeting history in one profile.
17 events from the most recent confirmed update back to the earliest known activity.
SentinelLabs reported that since 2017 it had identified at least five ShadowPad activity clusters, including APT41, Tick and Tonto Team, Operation Redbonus, Operation Redkanku, and Fishmonger, and argued the malware is privately sold rather than openly shared.
Kaspersky released a detailed report on Operation ShadowHammer, describing trojanized ASUS Live Update binaries, compromised signing material, over 600 target MAC addresses, and links to ShadowPad-related tooling.
Norfolk Infosec states Kaspersky published details on March 25 about the ASUS supply-chain compromise, including that malicious code was pushed through ASUS Live Update.
Kaspersky researchers discovered the trojanized ASUS Live Updater at the end of January 2019, uncovering a supply-chain attack that selectively targeted victims by MAC address.
Kaspersky assessed that the attackers changed payload start routines between late July and September 2018 during the ASUS supply-chain operation, likely to improve evasion.
Kaspersky noted Reddit discussions in June 2018 and September 2018 about suspicious ASUS Live Update behavior, suggesting malicious delivery may have started as early as June 2018.
Kaspersky identified related ASUS compromise samples compiled between June and July 2018 that contacted asushotfix[.]com, indicating the ShadowHammer activity was underway by mid-2018.
The tampering of Piriform's CCleaner installer was disclosed on September 18, 2017; about 2.27 million users downloaded the trojanized installer, while only 40 systems received the second-stage payload.
Avast acquired Piriform on July 18, 2017, shortly after the period during which the CCleaner build environment had been compromised.
Investigators determined ShadowPad was installed on four Piriform systems on April 12, 2017, and keylogger logs showed keystroke collection began the same day.
Investigators found a preliminary version of the CCleaner attack's stage-two binary installed on Piriform computers on March 12, 2017, indicating attacker presence in the environment before public disclosure.
Avast said malware was introduced into Piriform's build server sometime between March 11 and July 4, 2017, enabling the later CCleaner supply-chain attack.
SentinelLabs reported that ShadowPad controller version 1.0 dates to 2015, marking the malware platform's emergence as a successor to PlugX.
Avast's updated CCleaner investigation disclosed that ShadowPad had been found on four Piriform computers, with decrypted logs showing keylogging activity and suggesting a custom build tailored for Piriform.
A follow-up analysis described the first-stage ASUS malware as a triage tool that hashed MAC addresses, compared them to a hardcoded target list, and contacted asushotfix[.]com only for selected victims.
ESET published research stating that the gaming industry was still in scope for attackers in Asia, contributing reporting on the broader threat landscape tied to the story.
Kaspersky published research on ShadowPad in corporate networks, documenting the malware's presence and use in intrusions.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 62 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
6 references tracked. Mallory keeps watching after this page renders.
labs.sentinelone.com
Open sourcesecurelist.com
Open sourcenorfolkinfosec.com
Open sourcewelivesecurity.com
Open sourcesecurelist.com
Open sourceblog.avast.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and incident responders have tied **ShadowPad**, a privately sold modular backdoor associated with multiple PRC-linked espionage operations, to both major supply-chain compromises and ongoing targeted intrusions. ShadowPad has appeared in high-profile cases including **CCleaner**, **NetSarang**, and **ASUS ShadowHammer**, while a separate campaign used a trojanized installer for Pakistan’s government **E-Office** application to sideload a malicious `mscoree.dll` loader and deploy an encrypted ShadowPad payload. Trend Micro observed victims in Pakistan spanning a government entity, a public sector bank, and a telecommunications provider, with follow-on activity including credential theft via Mimikatz and data exfiltration over PowerShell BITS. ShadowPad was also among the malware families deployed after mass exploitation of Microsoft Exchange zero-days, underscoring its role as a reusable espionage platform across both opportunistic and highly selective operations. Defenders have responded by reverse engineering ShadowPad’s custom TCP, HTTP(S), and UDP command-and-control protocols and using protocol emulation to scan the Internet for live servers that would evade reputation-based detection. VMware and Virus Bulletin research identified dozens of active ShadowPad C2 nodes—roughly **72 to 83 servers** across overlapping study periods—and found that some accepted multiple protocols on the same port and overlapped with infrastructure used by **Spyder** and **ReverseWindow**. One previously identified ShadowPad C2 IP later surfaced in a real incident response case, showing that proactive C2 discovery can expose stealthy intrusions before conventional indicators trigger. Researchers caution that ShadowPad’s commercial, shared-use model complicates attribution, making infrastructure correlation and long-term tracking more reliable than assuming any single actor is responsible.
Aug 15, 2026
Researchers detailed how **ShadowPad**, a modular remote access trojan active since at least 2017, has been used by the Chinese threat group **BRONZE ATLAS**—also tracked as **APT41**, **Axiom**, **Winnti**, and **Wicked Panda**—and later adopted by multiple other Chinese espionage clusters. Secureworks and Sophos said the malware is commonly deployed through **DLL sideloading** and **DLL search order hijacking** with legitimate executables, using two-file and three-file execution chains, in-memory payload decryption, persistence through Windows services and registry keys, and process injection into child processes. The reporting links separate ShadowPad activity clusters to actors aligned with China’s **Ministry of State Security** and to **PLA-affiliated** groups whose targeting maps to Northern, Southern, and Western Theater Command regions.
Aug 14, 2026
Researchers reported a cyber-espionage campaign using the **ShadowPad** backdoor against industrial control system operators, telecommunications providers, and government-linked organizations in Pakistan, Afghanistan, Malaysia, and later Argentina-linked victimology. In several intrusions, attackers gained initial access through Microsoft Exchange Server exploitation tied to **`CVE-2021-26855`**, while another cluster used trojanized MSI installers for Pakistan government eOffice software to deliver a malicious **`mscoree.dll`** loader and encrypted payloads under **SYSTEM** privileges. Kaspersky said the activity began around March 2021 and assessed with high confidence that a Chinese-speaking threat actor was responsible, though it stopped short of a definitive link to **HAFNIUM**; Trend Micro likewise found overlaps with previously reported China-linked ShadowPad activity but said attribution remained inconclusive. The intrusions relied on multiple execution and persistence methods, including launching ShadowPad through the legitimate **AppLaunch.exe**, DLL hijacking via **OleView** with **`IVIEWERS.dll`** and **`IVIEWERS.dll.dat`**, and web-shell access consistent with tooling such as **China Chopper**. Post-compromise operations included credential theft, lateral movement, scheduled tasks, **Cobalt Strike**, **PlugX**, **Mimikatz**, **procdump**, **Nextnet** scanning, RAR archiving, and data exfiltration over **BITS**, indicating a sustained effort to harvest sensitive information from strategically important networks.
Aug 14, 2026