ShadowPad

12 avril 2017 : Déploiement de ShadowPad sur plusieurs postes et un serveur de build.

Payload : ShadowPad (persistance via tâche planifiée, vol de profil Firefox, collecte trafic réseau).

Multiple artifacts are described as “ShadowPad loader,” while a listed server is identified as a “ShadowPad C&C server.” | Two FmApp.dll samples are described as "ShadowPad loader," and a separate network indicator is labeled "ShadowPad C&C server."

Earth Lusca [is] known to rely heavily on Cobalt Strike, ShadowPad, Winnti and Spyder malware families.

SHADOWPAD is an actively developed and maintained modular remote access toolkit.

SHADOWPAD is an actively developed and maintained modular remote access toolkit.

This environment has already seen the emergence of the REF2924 intrusion set ... as well as the deployment of SHADOWPAD and COBALTSTRIKE.

Since March 18, 2025, we have identified that Earth Estries has been deploying the ShadowPad backdoor through multiple vectors within the compromised environment.

BRONZE BUTLER ... Tools ... ABK, BBK, Casper, Daserf, Datper, DGet, down_new, Ghostdown, Gofarer, gsecdump, Mimikatz, MSGet, Netboy, RarStar, Screen Capture Tool, ShadowPad, ShadowPy, T-SMB

Possible supply chain attack targeting Pakistan government delivers Shadowpad ... Mscoree.dll is a commonly used name for loaders of Shadowpad ... Shadowpad malware keeps being updated and shared among Chinese threat actors

The operation used a trojan called ShadowPad, thought to have links to contractors serving China's Ministry of State Security (MSS).

SparklingGoblin is one of the groups with access to the ShadowPad backdoor.

Cybersecurity researchers have detailed the inner workings of ShadowPad, a sophisticated and modular backdoor that has been adopted by a growing number of Chinese threat groups in recent years... ShadowPad is a remote access trojan capable of maintaining persistent access to compromised computers and executing arbitrary commands and next-stage payloads.

AvastおよびESETからTmangerファミリに関するブログが公開されました。そこでは特にTmangerとAlbaniiutasについて... LuckyMouseやShadowPadとの関連性が示されています。

Cybersecurity researchers have detailed the inner workings of ShadowPad, a sophisticated and modular backdoor that has been adopted by a growing number of Chinese threat groups in recent years... ShadowPad is a remote access trojan capable of maintaining persistent access to compromised computers and executing arbitrary commands and next-stage payloads.

The MSP was compromised by multiple persistent Shadowpad malware infections on multiple internet egress points used by the MSP.

We have only one domain name that has been used by Shadowpad as a C&C server in both incident response investigations we conducted.

APT41 used the new builder of shadowpad in 2021, which was mentioned in Ptsecurity’s report

Hunt.io. (2025, April 8). State-Sponsored Tactics: How Gamaredon and ShadowPad Operate and Rotate Their Infrastructure.

The privately developed ShadowPad backdoor was sold to multiple suspected PLA units, including RedFoxtrot and Tonto Team, and shared with entities like Chengdu404, whose staff were charged for activity attributed to APT41.

This includes an unreported cluster dubbed SteppeDriver that was first discovered in 2024 and has since targeted entities in France, Mongolia, and South America using tools like ShadowPad, COOLCLIENT, CurlyDoor, RudeGull, and MKTDownloader.

Using our telemetry data, we found that the threat actor also dropped PlugX and ShadowPad samples in victim environments.

ShadowPad is a modular remote access Trojan (RAT) that is closely associated with China-based APT groups. Because of its modular nature, ShadowPad can be continuously updated with new functionalities.

ShadowPad is a modular remote access Trojan (RAT) that is closely associated with China-based APT groups. Because of its modular nature, ShadowPad can be continuously updated with new functionalities.

ShadowPad is a modular remote access Trojan (RAT) that is closely associated with China-based APT groups. Because of its modular nature, ShadowPad can be continuously updated with new functionalities.

Злоумышленники также используют и хорошо известное ВПО: PlugX, ShadowPad, Poison Ivy, модифицированный вариант PcShare и публичный шелл ReVBShell.

Злоумышленники также используют и хорошо известное ВПО: PlugX, ShadowPad, Poison Ivy, модифицированный вариант PcShare и публичный шелл ReVBShell.

A connection with the ShadowPad backdoor, which is now used by at least five different threat actors, was also found.

A connection with the ShadowPad backdoor, which is now used by at least five different threat actors, was also found.

THREAT ACTOR NAME Webworm (linked: SixLittleMonkeys, FishMonger; cross-tracker: Space Pirates, ShadowPad / SNAPPYBEE)

Once access was established, SHADOW-EARTH-053 deployed ShadowPad, a modular malware family historically associated with multiple China-aligned intrusion sets, including APT41. The group relied heavily on DLL sideloading techniques involving signed legitimate executables.

The group’s toolset spans Linux implants—RushDrop, DriveSwitch, SilentRaid, and Bulbature—and Windows payloads such as RedLeaves and ShadowPad.

"...led to the deployment of ShadowPad that's obfuscated using ScatterBrain."

"...led to the deployment of ShadowPad that's obfuscated using ScatterBrain."

"...led to the deployment of ShadowPad that's obfuscated using ScatterBrain."

They said LuoYu have newly used the following malware since JSAC2021: Malware: XDealer, ShadowPad, PlugX

“Malware such as PlugX and ShadowPad... became central to campaigns attributed to APT3, APT41, GALLIUM, and Winnti.”

“Malware such as PlugX and ShadowPad... became central to campaigns attributed to APT3, APT41, GALLIUM, and Winnti.”

Cisco Talos discovered a malicious campaign that compromised a Taiwanese government-affiliated research institute that started as early as July 2023, delivering the ShadowPad malware, Cobalt Strike and other customized tools for post-compromise activities.

"...documents detailing how i-SOON supported the development of the notorious Remote Access Trojan (RAT), ShadowPad."

... deployed ShadowPad, a malware widely shared by Chinese state-sponsored actors.

"Ink Dragon leverages a custom ShadowPad IIS Listener module to turn compromised servers into active nodes within a distributed mesh..."

Some of the notable Windows implants ... include RedLeaves (aka BUGJUICE) and ShadowPad, both exclusively linked to Chinese hacking groups.