ShadowPad Malware Platform Proves a Threat to Watch

guest · Aug 20, 2021

ShadowPad Malware Platform Proves a Threat to Watch
Researchers who investigated the privately sold malware platform find a new controller -- and new implications for the Chinese espionage threat landscape
August 19, 2021
https://www.darkreading.com/threat-intelligence/shadowpad-malware-platform-proves-a-threat-to-watch

Security researchers who took a deep dive into the ShadowPad malware platform discovered a new controller and several details that shed light on how this modular malware operates and may pose a threat to enterprise defenders.

ShadowPad first emerged in 2015 and is used by at least four clusters of espionage activity, report SentinelLabs researchers who have been analyzing the threat. It has been involved in multiple, high-profile supply chain attacks, including CCleaner, NetSarang, and ShadowHammer.
Click to expand...

Over the years, the malware platform has spread across state-sponsored Chinese groups that previously relied on attack tools such as PlugX, RedLeaves, and other remote access Trojans (RATs). Prior to ShadowPad's emergence, there was a sense of a "digital order master" sharing the malware among threat groups but no concrete understanding of how the process worked.

"ShadowPad is the preferred, or more desirable, tool for these groups and starts to replace tools like PlugX that had been around for so long," says J.A. Guerrero-Saade, principal threat researcher at SentinelOne, While the relationship between PlugX and ShadowPad has been discussed, the new findings indicate ShadowPad is "highly likely" to be the successor to PlugX.
Unlike PlugX, which is publicly sold, ShadowPad is privately shared among a limited set of users. It is a modular platform, which Guerrero-Saade says is significant.
Click to expand...

ShadowPad is a modular backdoor in shellcode format. When it's executed, a layer of an obfuscated shellcode loader decrypts and loads a Root plugin.

But researchers found ShadowPad wasn't designed as a collaborative framework. Only plug-ins created by the original developer can be included and used in the ShadowPad controller, and its seller has tight control over them.

"Looking deeply into the plugin numbers and the distribution of different plugins embedded in around a hundred samples, we assessed that the seller is likely selling each plugin separately instead of offering a full bundle with all of the currently available plugins," researchers explain.
Click to expand...

SentinelLabs: ShadowPad | A Masterpiece of Privately Sold Malware in Chinese Espionage

Executive Summary

ShadowPad is a privately sold modular malware platform –rather than an open attack framework– with plugins sold separately.

ShadowPad is still regularly updated with more advanced anti-detection and persistence techniques.

It’s used by at least four clusters of espionage activity. ShadowPad was the primary backdoor for espionage operations in multiple campaigns, including the CCleaner, NetSarang, and ASUS supply-chain attacks.

The adoption of ShadowPad significantly reduces the costs of development and maintenance for threat actors. We observed that some threat groups stopped developing their own backdoors after they gained access to ShadowPad.

As a byproduct of that shared tooling, any claim on attribution needs to be reviewed in a cautious way when a shared backdoor like ShadowPad is involved.

Instead of focusing on specific threat groups, we discuss local personas possibly involved in the development of ShadowPad as an iterative successor to PlugX.

Click to expand...

Log in or Sign up

ShadowPad Malware Platform Proves a Threat to Watch

guest Guest

Log in or Sign up

ShadowPad Malware Platform Proves a Threat to Watch

guest Guest

Useful Searches