Threat intelligence / Malware

ShadowPad

[ShadowPad](https://attack.mitre.org/software/S0596) is a modular backdoor that was first identified in a supply chain compromise of the NetSarang software in mid-July 2017. The malware was originally thought to be exclusively used by [APT41](https://attack.mitre.org/groups/G0096), but has since been observed to be used by various Chinese threat activity groups. (Citation: Recorded Future RedEcho Feb 2021)(Citation: Securelist ShadowPad Aug 2017)(Citation: Kaspersky ShadowPad Aug 2017)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[ShadowPad](https://attack.mitre.org/software/S0596) is a modular backdoor that was first identified in a supply chain compromise of the NetSarang software in mid-July 2017. The malware was originally thought to be exclusively used by [APT41](https://attack.mitre.org/groups/G0096), but has since been observed to be used by various Chinese threat activity groups. (Citation: Recorded Future RedEcho Feb 2021)(Citation: Securelist ShadowPad Aug 2017)(Citation: Kaspersky ShadowPad Aug 2017)

Labels

malware

31 recorded

Relationships

uses

from APT41

Group

uses

from Aquatic Panda

Group

uses

from BRONZE BUTLER

Group

uses

from Earth Lusca

Group

uses

from Indian Critical Infrastructure Intrusions

Campaign

uses

from Mustang Panda

Group

uses

from RedDelta Modified PlugX Infection Chain Operations

Campaign

uses

Group

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to DNS

Technique

uses

to Domain Generation Algorithms

Technique

uses

to Dynamic-link Library Injection

Technique

uses

to Fileless Storage

Technique

uses

to File Transfer Protocols

Technique

uses

to Indicator Removal

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Local Storage Discovery

Technique

uses

to Modify Registry

Technique

uses

to Non-Application Layer Protocol

Technique

uses

to Non-Standard Encoding

Technique

uses

to Obfuscated Files or Information

Technique

uses

to Process Discovery

Technique

uses

to Process Injection

Technique

uses

to Scheduled Transfer

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to System Time Discovery

Technique

uses

to Web Protocols

Technique

uses

from Tonto Team

Group

uses

from Tropic Trooper

Group

6 external

References

mitre-attack

S0596

POISONPLUG.SHADOW

—

FireEye APT41 Aug 2019

https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf

Securelist ShadowPad Aug 2017

https://securelist.com/shadowpad-in-corporate-networks/81432/

Recorded Future RedEcho Feb 2021

https://go.recordedfuture.com/hubfs/reports/cta-2021-0228.pdf

Kaspersky ShadowPad Aug 2017

https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2017/08/07172148/ShadowPad_technical_description_PDF.pdf