SecuriTricks - shadowpad

Inside Shadow-Earth-053: A China-Aligned Cyberespionage Campaign Against Government and Defense Sectors in Asia

A China-aligned threat group designated SHADOW-EARTH-053 has been conducting cyberespionage operations against government entities and critical infrastructure across at least eight countries in South, East, and Southeast Asia, plus one NATO member state, since December 2024. The group exploits unpa…

shadowpad

godzilla

ringq

vshell

2026-04-30

exchange server compromise

godzilla webshell

noodlerat

proxylogon exploitation

Published: April 30, 2026

Linked vulnerabilities : CVE-2021-26855, CVE-2021-26858, CVE-2021-26857, CVE-2021-27065, CVE-2025-55182 (CVSS 10.0)

Downloadable IOCs: 44

Knife Cutting the Edge: Disclosing a China-nexus gateway-monitoring AitM framework

Cisco Talos uncovered 'DKnife', a sophisticated gateway-monitoring and adversary-in-the-middle (AitM) framework comprising seven Linux-based implants. Used since 2019, DKnife performs deep-packet inspection, traffic manipulation, and malware delivery via routers and edge devices. It targets various…

Published: February 5, 2026

Downloadable IOCs: 80

Follow the Smoke | China-nexus Threat Actors Hammer At the Doors of Top Tier Targets

The research outlines China-nexus threat actors targeting SentinelOne and other organizations between 2024 and 2025. It details intrusions into an IT services company managing SentinelOne's hardware logistics and reconnaissance of SentinelOne's servers. The attacks involved ShadowPad malware and a …

Published: June 10, 2025

Linked vulnerabilities : CVE-2024-8190 (CVSS 7.2), CVE-2024-8963 (CVSS 9.1), CVE-2024-1709, CVE-2023-46747

Downloadable IOCs: 24

The Persistent Threat of Salt Typhoon: Tracking Exposures of Potentially Targeted Devices

Salt Typhoon, a Chinese state-sponsored threat actor, has been targeting major telecommunications providers worldwide by exploiting vulnerabilities in network devices. This analysis tracks global exposures of internet-facing devices associated with Salt Typhoon activity over six months, including S…

vulnerability exploitation

CVE-2023-48788

CVE-2022-3236

masol rat

ivanti connect secure

2025-04-26

chinese state-sponsored

fortinet forticlient ems

Published: April 26, 2025

Downloadable IOCs: 0

You will always remember this as the day you finally caught FamousSparrow

ESET researchers uncovered new activity by the FamousSparrow APT group, including two undocumented versions of their SparrowDoor backdoor. The group compromised a US financial sector trade group and a Mexican research institute in July 2024. The new SparrowDoor versions show significant improvement…

Published: March 26, 2025

Downloadable IOCs: 12

Operation FishMedley targeting governments, NGOs, and think tanks

ESET researchers have uncovered a global espionage operation called Operation FishMedley, conducted by the FishMonger APT group, which is operated by the Chinese contractor I-SOON. The campaign targeted governments, NGOs, and think tanks across Asia, Europe, and the United States during 2022. The a…

Published: March 21, 2025

Downloadable IOCs: 12

Updated Shadowpad Malware Leads to Ransomware Deployment

A recent investigation revealed Shadowpad malware being used to deploy a new ransomware family in Europe. The threat actor targeted 21 companies across 15 countries, primarily in the manufacturing sector. Access was gained through remote network attacks, exploiting weak passwords and bypassing mult…

multi-factor authentication bypass

remote network attacks

intellectual property theft

cqhashdumpv2

Published: February 20, 2025

Downloadable IOCs: 0

MOONSHINE Exploit Kit and DarkNimbus Backdoor Enabling Earth Minotaur's Multi-Platform Attacks

Earth Minotaur, a threat actor targeting Tibetan and Uyghur communities, utilizes the MOONSHINE exploit kit to compromise Android devices and install the DarkNimbus backdoor. The exploit kit targets vulnerabilities in instant messaging apps, particularly WeChat, and has been updated with new exploi…

Published: December 5, 2024

Downloadable IOCs: 0

Chinese APT Abuses VSCode to Target Government in Asia

The report details a campaign by the Chinese advanced persistent threat (APT) group Stately Taurus, which carried out cyberespionage operations against government entities in Southeast Asia. The group employed a novel technique that leveraged the reverse shell feature of Visual Studio Code to gain …

Published: September 9, 2024

Downloadable IOCs: 17

Likely compromise of Taiwanese government-affiliated research institute with ShadowPad and Cobalt Strike

A government-affiliated Taiwanese research institute specializing in computing technologies experienced a cyber intrusion likely carried out by the Chinese hacking group APT41. The attackers employed ShadowPad malware, Cobalt Strike, and custom tools, exploiting vulnerabilities like CVE-2018-0824 f…

Published: August 2, 2024

Linked vulnerabilities : CVE-2018-0824

Downloadable IOCs: 13

China-Nexus Threat Group ‘Velvet Ant’ Abuses F5 Load Balancers for Persistence

Published: June 18, 2024

Downloadable IOCs: 5

Tag: shadowpad

Attack reports

Inside Shadow-Earth-053: A China-Aligned Cyberespionage Campaign Against Government and Defense Sectors in Asia

Knife Cutting the Edge: Disclosing a China-nexus gateway-monitoring AitM framework

ShadowRelay: New Modular Backdoor in the Public Sector

Targets high value telecommunications infrastructure in South Asia

Ink Dragon's Relay Network and Stealthy Offensive Operation

Earth Entries alive and kicking

ToolShell Used to Compromise Telecoms Company in Middle East

Follow the Smoke | China-nexus Threat Actors Hammer At the Doors of Top Tier Targets

The Persistent Threat of Salt Typhoon: Tracking Exposures of Potentially Targeted Devices

You will always remember this as the day you finally caught FamousSparrow

Operation FishMedley targeting governments, NGOs, and think tanks

Updated Shadowpad Malware Leads to Ransomware Deployment

MOONSHINE Exploit Kit and DarkNimbus Backdoor Enabling Earth Minotaur's Multi-Platform Attacks

Chinese APT Abuses VSCode to Target Government in Asia

Likely compromise of Taiwanese government-affiliated research institute with ShadowPad and Cobalt Strike

China-Nexus Threat Group ‘Velvet Ant’ Abuses F5 Load Balancers for Persistence