ShadowPad

  • First known sample

    2017
  • Discovery

    2017
  • Number of targets

    Unknown
  • Current status

    Active
  • Type

    Backdoor
  • TOP targeted countries

    Worldwide
  • The way of propagation

    Trojanized software installers
  • Purpose/Functions

    Remote control
  • Special features
    ShadowPad is an example of the dangers posed by a successful supply-chain attack. Given the opportunities for covert data collection, attackers are likely to pursue this type of attack again and again with other widely used software components. Please find more information here.
  • Targets

    Construction , Electronics manufacturing , Financial institutions , Heavy industry manufacturers , Manufacturing , Media , Medical Industry , Software companies , Telecoms , Transportation , Energy
  • Artefacts/Attribution
    Attribution is hard and attackers were very careful to not leave obvious traces, however certain techniques were known to be used in another malware like PlugX and Winnti which were allegedly developed by Chinese-speaking actors.
  • Description

    A supply chain attack in 2017 that delivered a backdoor Trojan hidden in modified versions of software produced by NetSarang, a developer of network connectivity solutions. Once inside a system, the malware can upload files, create processes, and store information.

    Additional information