Likely compromise of Taiwanese government-affiliated research institute with ShadowPad and Cobalt Strike

Tags

External References

• https://blog.talosintelligence.com/
• https://otx.alienvault.com/

Description

A government-affiliated Taiwanese research institute specializing in computing technologies experienced a cyber intrusion likely carried out by the Chinese hacking group APT41. The attackers employed ShadowPad malware, Cobalt Strike, and custom tools, exploiting vulnerabilities like CVE-2018-0824 for privilege escalation. They gathered information, deployed backdoors, harvested credentials, and exfiltrated data. Evidence suggests the threat actor spoke Chinese and followed open-source anti-detection techniques.

Date