SecuriTricks - shadowpad

The Persistent Threat of Salt Typhoon: Tracking Exposures of Potentially Targeted Devices

Salt Typhoon, a Chinese state-sponsored threat actor, has been targeting major telecommunications providers worldwide by exploiting vulnerabilities in network devices. This analysis tracks global exposures of internet-facing devices associated with Salt Typhoon activity over six months, including S…

network devices

CVE-2024-21887

CVE-2023-46805

shadowpad

telecommunications

vulnerability exploitation

CVE-2023-48788

CVE-2022-3236

masol rat

ivanti connect secure

2025-04-26

chinese state-sponsored

fortinet forticlient ems

Published: April 26, 2025

Downloadable IOCs: 0

MOONSHINE Exploit Kit and DarkNimbus Backdoor Enabling Earth Minotaur's Multi-Platform Attacks

Earth Minotaur, a threat actor targeting Tibetan and Uyghur communities, utilizes the MOONSHINE exploit kit to compromise Android devices and install the DarkNimbus backdoor. The exploit kit targets vulnerabilities in instant messaging apps, particularly WeChat, and has been updated with new exploi…

Published: December 5, 2024

Downloadable IOCs: 0

Chinese APT Abuses VSCode to Target Government in Asia

The report details a campaign by the Chinese advanced persistent threat (APT) group Stately Taurus, which carried out cyberespionage operations against government entities in Southeast Asia. The group employed a novel technique that leveraged the reverse shell feature of Visual Studio Code to gain …

Published: September 9, 2024

Downloadable IOCs: 17

Likely compromise of Taiwanese government-affiliated research institute with ShadowPad and Cobalt Strike

A government-affiliated Taiwanese research institute specializing in computing technologies experienced a cyber intrusion likely carried out by the Chinese hacking group APT41. The attackers employed ShadowPad malware, Cobalt Strike, and custom tools, exploiting vulnerabilities like CVE-2018-0824 f…

Published: August 2, 2024

Linked vulnerabilities : CVE-2018-0824

Downloadable IOCs: 13

China-Nexus Threat Group ‘Velvet Ant’ Abuses F5 Load Balancers for Persistence

Published: June 18, 2024

Downloadable IOCs: 5

Tag: shadowpad

Attack reports

The Persistent Threat of Salt Typhoon: Tracking Exposures of Potentially Targeted Devices

You will always remember this as the day you finally caught FamousSparrow

Operation FishMedley targeting governments, NGOs, and think tanks

Updated Shadowpad Malware Leads to Ransomware Deployment

MOONSHINE Exploit Kit and DarkNimbus Backdoor Enabling Earth Minotaur's Multi-Platform Attacks

Chinese APT Abuses VSCode to Target Government in Asia

Likely compromise of Taiwanese government-affiliated research institute with ShadowPad and Cobalt Strike

China-Nexus Threat Group ‘Velvet Ant’ Abuses F5 Load Balancers for Persistence