ShadowPad

China and India Cyberespionage Converge on Pakistani Law Enforcement

• Cybercriminals

China and India Cyberespionage Converge on Pakistani Law Enforcement

Do Son July 16, 2026 0

SentinelLABS found Chinese cyberespionage and India-nexus actors converging on Pakistani law enforcement, hitting Balochistan Police records and citizens.

The N-Day Nightmare: How SHADOW-EARTH-053 Breaches Governments Using “Old” Exploits

• Cyber Security
• Vulnerability Report

The N-Day Nightmare: How SHADOW-EARTH-053 Breaches Governments Using “Old” Exploits

Do Son May 5, 2026 0

SHADOW-EARTH-053 is breaching governments and NATO using old ProxyLogon flaws and ShadowPad. Learn how this China-aligned group stays hidden via registry loading.

The “All-in-One” Spy: DKnife Malware Hijacks Routers to Swap Downloads

• Cyber Security
• Malware

The “All-in-One” Spy: DKnife Malware Hijacks Routers to Swap Downloads

Do Son February 9, 2026 0

Cisco Talos exposes DKnife, a router malware that inspects traffic and swaps legitimate downloads for ShadowPad backdoors. Active since 2019.

Ink Dragon’s Global Mesh: How Chinese Spies Turn Compromised Government Servers into C2 Relay Nodes

• Cyber Security
• Malware

Ink Dragon’s Global Mesh: How Chinese Spies Turn Compromised Government Servers into C2 Relay Nodes

Do Son December 18, 2025 0

Ink Dragon is weaponizing government servers in Europe using a relay-centric mesh. By hijacking IIS servers, they mask C2 traffic across global networks.

Critical WSUS RCE (CVE-2025-59287) Actively Exploited to Deploy ShadowPad Backdoor

• Cyber Security
• Vulnerability Report

Critical WSUS RCE (CVE-2025-59287) Actively Exploited to Deploy ShadowPad Backdoor

Do Son November 21, 2025 0

Threat actors are actively exploiting a new WSUS RCE flaw (CVE-2025-59287) to gain SYSTEM shells and deploy the dangerous ShadowPad backdoor. Patch immediately!

China-Aligned APTs Launch “Premier Pass-as-a-Service,” Sharing Access in Coordinated Global Espionage

• Cyber Security

China-Aligned APTs Launch “Premier Pass-as-a-Service,” Sharing Access in Coordinated Global Espionage

Do Son October 27, 2025 0

Trend exposed "Premier Pass-as-a-Service," a model where Earth Estries (access broker) and Earth Naga (APT36) share compromised network access to deploy ShadowPad in a coordinated espionage campaign.

Symantec Exposes Chinese APT Overlap: Zingdoor, ShadowPad, and KrustyLoader Used in Global Espionage

• Cyber Security
• Malware

Symantec Exposes Chinese APT Overlap: Zingdoor, ShadowPad, and KrustyLoader Used in Global Espionage

Do Son October 23, 2025 0

Symantec exposed a complex Chinese APT network (Glowworm/UNC5221) deploying Zingdoor and ShadowPad across US/South American targets. The groups abuse DLL sideloading and PetitPotam for credential theft.

Chinese Cyberespionage Groups Probe SentinelOne in Sophisticated ShadowPad and PurpleHaze Campaigns

• Cybercriminals

Chinese Cyberespionage Groups Probe SentinelOne in Sophisticated ShadowPad and PurpleHaze Campaigns

Do Son June 10, 2025 0

SentinelLABS exposes China-nexus APTs (ShadowPad, PurpleHaze) targeting SentinelOne and over 70 organizations in extensive cyber-espionage.

Updated ShadowPad Malware Facilitates Ransomware Deployment in Global Attacks

• Malware

Updated ShadowPad Malware Facilitates Ransomware Deployment in Global Attacks

Do Son February 20, 2025 0

Explore the evolving threat of ShadowPad malware, now facilitating ransomware attacks linked to Chinese threat actors.

China-Nexus Espionage: ScatterBrain Obfuscation Tactics Revealed

• Malware

China-Nexus Espionage: ScatterBrain Obfuscation Tactics Revealed

Do Son January 30, 2025 0

Discover ScatterBrain, a powerful obfuscating compiler employed by APT41. Understand its role in protecting the advanced modular backdoor POISONPLUG.SHADOW.

Chinese APT Stately Taurus Exploits Visual Studio Code in Cyberespionage Attacks

• Cyber Security
• Malware

Chinese APT Stately Taurus Exploits Visual Studio Code in Cyberespionage Attacks

Do Son September 9, 2024 0

Discover the latest tactic employed by the Chinese APT group Stately Taurus. Learn how they abuse Visual Studio Code to gain unauthorized access to sensitive networks.

Chinese APT41 Group Breaches Taiwanese Research Institute

• Cyber Security

Chinese APT41 Group Breaches Taiwanese Research Institute

Do Son August 1, 2024 0

Discover the details of a recent cyberattack targeting a Taiwanese research institute, believed to be carried out by the Chinese state-sponsored group APT41