Researchers Expose Over 80 ShadowPad Malware C2 Servers

As many as 85 command-and-control (C2) servers have been
discovered^[1]
supported by the ShadowPad malware since September 2021, with
infrastructure detected as recently as October 16, 2022.

That’s according to VMware’s Threat Analysis Unit (TAU), which
studied^[2]
three ShadowPad variants using TCP, UDP, and HTTP(S) protocols for
C2 communications.

ShadowPad^[3], seen as a successor to
PlugX^[4], is a modular malware
platform privately shared among multiple Chinese state-sponsored
actors since 2015.

Taiwanese cybersecurity firm TeamT5, earlier this May, disclosed
details of another China-nexus modular implant named Pangolin8RAT^[5], which is believed to be
the successor of the PlugX and ShadowPad malware families, linking
it to a threat group dubbed Tianwu.

An analysis of the three ShadowPad artifacts, which have been
previously put to use by Winnti^[6], Tonto Team^[7], and an emerging threat
cluster codenamed Space Pirates^[8], made it possible to
discover the C2 servers by scanning the list of open hosts
generated by a tool called ZMap^[9], VMware said.

The company further disclosed it identified Spyder^[10] and ReverseWindow^[11] malware samples
communicating with ShadowPad C2 IP addresses, both of which are
malicious tools^[12] put to use by APT41
(aka Winnti) and LuoYu^[13].

Additionally, overlaps have been observed between the
aforementioned Spyder sample and a Worker component of the threat
actor’s Winnti 4.0 trojan^[14].

“Scanning APT malware C2s on the Internet is sometimes like
finding a needle in a haystack,” Takahiro Haruyama, senior threat
researcher at VMware TAU, said. “However, once the C2 scanning
works, it can become a game changer as one of the most proactive
threat detection approaches.”