Loading story…
Researchers reported a cyber-espionage campaign using the ShadowPad backdoor against industrial control system operators, telecommunications providers, and government-linked organizations in Pakistan, Afghanistan, Malaysia, and later Argentina-linked victimology. In several intrusions, attackers gained initial access through Microsoft Exchange Server exploitation tied to CVE-2021-26855, while another cluster used trojanized MSI installers for Pakistan government eOffice software to deliver a malicious mscoree.dll loader and encrypted payloads under SYSTEM privileges. Kaspersky said the activity began around March 2021 and assessed with high confidence that a Chinese-speaking threat actor was responsible, though it stopped short of a definitive link to HAFNIUM; Trend Micro likewise found overlaps with previously reported China-linked ShadowPad activity but said attribution remained inconclusive.
The intrusions relied on multiple execution and persistence methods, including launching ShadowPad through the legitimate AppLaunch.exe, DLL hijacking via OleView with IVIEWERS.dll and IVIEWERS.dll.dat, and web-shell access consistent with tooling such as China Chopper. Post-compromise operations included credential theft, lateral movement, scheduled tasks, Cobalt Strike, PlugX, Mimikatz, procdump, Nextnet scanning, RAR archiving, and data exfiltration over BITS, indicating a sustained effort to harvest sensitive information from strategically important networks.
TTPs, infrastructure, and targeting history in one profile.
9 events from the most recent confirmed update back to the earliest known activity.
Trend Micro reported that version 2.0.3 of the legitimate Pakistani government eOffice installer was available on a governmental website between April and July 2023.
In March 2023, Trend Micro identified a suspicious earlier detection involving mscoree.dll, a filename commonly associated with ShadowPad loaders, prompting further investigation into the Pakistan eOffice installer case.
Trend Micro said it noticed in March 2023 a prior detection hit from September 2022 for mscoree.dll in an uncommon directory, which helped surface the Pakistan eOffice-related intrusion.
Trend Micro reported that data exfiltration via BITS used an attacker-controlled server that was active from late April 2022 to late October 2022.
Beginning around mid-October 2021, the threat actor changed tactics and began delivering ShadowPad through DLL hijacking in the legitimate OleView tool using IVIEWERS.dll and IVIEWERS.dll.dat.
In mid-October 2021, Kaspersky ICS CERT discovered an active ShadowPad infection on engineering computers in building automation systems belonging to a telecommunications company in Pakistan.
From March to October 2021, attackers deployed ShadowPad as a malicious mscoree.dll launched by the legitimate AppLaunch.exe, using scheduled tasks for persistence.
Kaspersky reported that the ShadowPad espionage campaign apparently began in March 2021, targeting organizations in Pakistan and Afghanistan, with some intrusions later tied to industrial control system environments.
Kaspersky assessed that the ShadowPad intrusion affecting a national telecom company in Pakistan likely began with exploitation of Microsoft Exchange CVE-2021-26855 (ProxyLogon). The attackers then deployed a malicious DLL web shell on the mail server and installed Cobalt Strike as a Windows service.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 41 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
ics-cert.kaspersky.com
Open sourcemandiant.com
Open sourcecve.mitre.org
Open sourcemedia.kasperskycontenthub.com
Open sourcevirusbulletin.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and incident responders have tied **ShadowPad**, a privately sold modular backdoor associated with multiple PRC-linked espionage operations, to both major supply-chain compromises and ongoing targeted intrusions. ShadowPad has appeared in high-profile cases including **CCleaner**, **NetSarang**, and **ASUS ShadowHammer**, while a separate campaign used a trojanized installer for Pakistan’s government **E-Office** application to sideload a malicious `mscoree.dll` loader and deploy an encrypted ShadowPad payload. Trend Micro observed victims in Pakistan spanning a government entity, a public sector bank, and a telecommunications provider, with follow-on activity including credential theft via Mimikatz and data exfiltration over PowerShell BITS. ShadowPad was also among the malware families deployed after mass exploitation of Microsoft Exchange zero-days, underscoring its role as a reusable espionage platform across both opportunistic and highly selective operations. Defenders have responded by reverse engineering ShadowPad’s custom TCP, HTTP(S), and UDP command-and-control protocols and using protocol emulation to scan the Internet for live servers that would evade reputation-based detection. VMware and Virus Bulletin research identified dozens of active ShadowPad C2 nodes—roughly **72 to 83 servers** across overlapping study periods—and found that some accepted multiple protocols on the same port and overlapped with infrastructure used by **Spyder** and **ReverseWindow**. One previously identified ShadowPad C2 IP later surfaced in a real incident response case, showing that proactive C2 discovery can expose stealthy intrusions before conventional indicators trigger. Researchers caution that ShadowPad’s commercial, shared-use model complicates attribution, making infrastructure correlation and long-term tracking more reliable than assuming any single actor is responsible.
Aug 15, 2026
Researchers have tied **ShadowPad**, a modular malware platform sold privately rather than shared openly, to multiple high-profile espionage operations and supply-chain compromises. Analysis indicates the backdoor emerged as a successor to `PlugX` and has been used by several China-linked activity clusters, including subgroups associated with **APT41** as well as actors previously linked to **Axiom**. Investigators say ShadowPad’s architecture allows its developer to restrict plugin access per customer, helping multiple espionage teams reuse the same malware while complicating attribution and lowering development costs for operators. ShadowPad has surfaced in several notable intrusions, including the **CCleaner** compromise, where a trojanized installer reached about **2.27 million** users but a second-stage payload was delivered to only **40** selected systems; investigators also found ShadowPad on Piriform machines with decrypted logs showing **keylogging** activity. It was also linked to **Operation ShadowHammer**, in which attackers trojanized **ASUS Live Update** binaries that retained valid ASUSTeK signatures and selectively activated only on devices whose network-adapter `MAC` addresses matched hardcoded target lists before contacting `asushotfix[.]com` for a second stage. Reporting also connects related activity to compromises involving **NetSarang**, corporate networks, and Asian gaming-sector targets, reinforcing ShadowPad’s role as a recurring tool in selective, supply-chain-enabled Chinese espionage.
Aug 15, 2026
Researchers detailed how **ShadowPad**, a modular remote access trojan active since at least 2017, has been used by the Chinese threat group **BRONZE ATLAS**—also tracked as **APT41**, **Axiom**, **Winnti**, and **Wicked Panda**—and later adopted by multiple other Chinese espionage clusters. Secureworks and Sophos said the malware is commonly deployed through **DLL sideloading** and **DLL search order hijacking** with legitimate executables, using two-file and three-file execution chains, in-memory payload decryption, persistence through Windows services and registry keys, and process injection into child processes. The reporting links separate ShadowPad activity clusters to actors aligned with China’s **Ministry of State Security** and to **PLA-affiliated** groups whose targeting maps to Northern, Southern, and Western Theater Command regions.
Aug 14, 2026