Monday, May 19, 2025
HomeCyber Security NewsShadowPad Modular Malware Platform Used by Chinese Hackers in High-profile Attacks

ShadowPad Modular Malware Platform Used by Chinese Hackers in High-profile Attacks

Published on

SIEM as a Service

Follow Us on Google News

A very sophisticated and modular backdoor, ShadowPad has been discovered recently by the cybersecurity analysts of Pwc and Secureworks security firm that is actively used by the Chinese threat actors to perform high-profile attacks.

This sophisticated malware came into the spotlight in the year 2017, and it caught the eyes of the security analysts when the malware has been used in two software supply-chain.

While this sophisticated malware is being decrypted by the hackers in the memory using a custom decryption algorithm.

- Advertisement - Google News

Who is Bronze Atlas, aka Barium?

This group is known under different names in the industry of security, and that’s why we have listed the names that are detected:-

  • APT41
  • Axiom
  • Barium
  • Wicked Panda
  • Winnti

The APT41 has executed different kinds of attacks and has attacked several organizations. In the initial stage of the ShadowPad attack, the threat actors have been traced as Bronze Atlas, aka Barium.

ShadowPad

After doing a proper investigation it’s been asserted that the ShadowPad is a RAT that is being used by the threat actors to implement shell commands and extra payloads.

The threat actors have initiated the attacks, where the ShadowPad is being processed on the infected or compromised systems of their targets.

So, there is no doubt that ShadowPad is deployed through a method known as DLL sideloading, and here the threat actors generally deliver all kinds of malicious code as a DLL.

Malicious DLL loader

However, the malicious DLL loader exports one apparently function named “log” this function generally helps to write a given string to %TEMP%\log.txt, and not only this, but it also does the exporting in its entry point function.

  • SHA-256: a8e5a1b15d42c4da97e23f5eb4a0adfd29674844ce906a86fa3554fc7e58d553
  • Filename: log.dll
  • File type: Win32 DLL
  • File size: 209,408 bytes
  • Compilation timestamp: 31/07/2020 08:08:43

Encoding algorithm

While there are some encoding algorithms, which is a stream cipher that generally takes a 32-bit value. Not only this, but we have mentioned the encoding algorithm below:-

  • Multiplies the current seed by 17;
  • Subtracts the 32-bit constant value 0x443246ba from the seed;
  • Stocks the result as the seed for the next iteration; and,
  • Aggregates each byte of the resultant seed to give the final XOR byte to utilize with the current encoded byte.

This type of malware payload is generally deployed to a host either encrypted within the DLL loader or embedded inside a separate file along with a DLL loader.

These types of attacks are quite popular, and sophisticated dues to which they do a lot of damage too. So, in this, it is very important to stay alerted and protected from this kind of malware attack.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates.

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Hackers Exploit AutoIT Scripts to Deploy Malware Targeting Windows Systems

Cybersecurity researchers have unearthed a sophisticated attack leveraging AutoIT, a long-standing scripting language known...

New Report Finds 67% of Organizations Experienced Cyber Attacks in the Last Year

A disturbing 67% of businesses in eight worldwide markets—the US, UK, Spain, the Netherlands,...

Auth0-PHP Vulnerability Enables Unauthorized Access for Attackers

Critical security vulnerability has been discovered in the Auth0-PHP SDK that could potentially allow...

Active Exploitation of Ivanti EPMM Zero-Day Vulnerability in the Wild

Security researchers at The Shadowserver Foundation have identified active exploitation attempts targeting a critical...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Hackers Exploit AutoIT Scripts to Deploy Malware Targeting Windows Systems

Cybersecurity researchers have unearthed a sophisticated attack leveraging AutoIT, a long-standing scripting language known...

New Report Finds 67% of Organizations Experienced Cyber Attacks in the Last Year

A disturbing 67% of businesses in eight worldwide markets—the US, UK, Spain, the Netherlands,...

Auth0-PHP Vulnerability Enables Unauthorized Access for Attackers

Critical security vulnerability has been discovered in the Auth0-PHP SDK that could potentially allow...