ShadowPad
-
The way of propagation
Trojanized software installers -
Purpose/Functions
Remote control -
Special features
ShadowPad is an example of the dangers posed by a successful supply-chain attack. Given the opportunities for covert data collection, attackers are likely to pursue this type of attack again and again with other widely used software components. Please find more information here.
-
Targets
Construction , Electronics manufacturing , Financial institutions , Heavy industry manufacturers , Manufacturing , Media , Medical Industry , Software companies , Telecoms , Transportation , Energy -
Artefacts/Attribution
Attribution is hard and attackers were very careful to not leave obvious traces, however certain techniques were known to be used in another malware like PlugX and Winnti which were allegedly developed by Chinese-speaking actors.
-
Description
A supply chain attack in 2017 that delivered a backdoor Trojan hidden in modified versions of software produced by NetSarang, a developer of network connectivity solutions. Once inside a system, the malware can upload files, create processes, and store information.