LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0596: ShadowPad

ShadowPad is a modular backdoor that was first identified in a supply chain compromise of the NetSarang software in mid-July 2017. The malware was originally thought to be exclusively used by APT41, but has since been observed to be used by various Chinese threat activity groups. [1][2][3]

EnterpriseS0596MalwareObject v1.3Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

ShadowPad matters because ATT&CK describes it as a modular Windows backdoor first identified through a NetSarang software supply chain compromise and later associated with multiple China-linked activity sets and campaigns. For leaders, the decision value is not just “malware exists”; it is whether the organization can detect a stealthy, modular backdoor that may arrive through trusted software channels, perform host and network discovery, communicate over common protocols such as web, file transfer, DNS, or other network protocols, and obscure or remove evidence.

Executive priority

Prioritize ShadowPad as a resilience and assurance scenario for Windows environments, third-party software trust, and critical-service operations. The relationship context includes campaigns and groups tied to critical infrastructure, government, telecom, technology, healthcare, transportation, finance, education, and other sectors, but local risk should be based on your exposure, geography, vendors, and threat model. Executives should ask: do we have evidence for supply chain software integrity, Windows endpoint visibility, network egress governance, DNS/web traffic monitoring, and incident response ability to investigate a modular backdoor without relying on a single indicator?

Technical view

ATT&CK provides no official detection text for ShadowPad, so defenders should validate coverage through the mapped behaviors. On Windows, confirm visibility for process injection and DLL injection, obfuscated files or information, fileless storage locations such as registry/WMI-style persistence or storage patterns where applicable, process/user/system/network discovery, scheduled transfer behavior, indicator removal, and C2 over web protocols, file transfer protocols, DNS, and non-application-layer protocols. Use the campaign and group relationships as threat-intelligence context, not as proof of local compromise or attribution.

Likely telemetry

  • Windows endpoint process creation and parent-child process telemetry
  • DLL load and process injection-related endpoint events
  • File, registry, WMI, and other non-file storage or configuration change telemetry where available
  • Command-line, script, and administrative utility execution logs for discovery activity
  • DNS query and response logs

Detection direction

  • Because MITRE does not provide a ShadowPad-specific detection recommendation, build behavior-based detections around the related techniques rather than relying only on hashes or names.
  • Tune for unusual Windows processes performing discovery of users, system information, network configuration, and running processes, especially when followed by outbound communications.
  • Validate analytic coverage for DLL/process injection and suspicious module loading, with allowlisting for legitimate security tools, software updaters, and enterprise management agents to reduce false positives.
  • Review DNS, web, file transfer, and non-application-layer egress for rare destinations, unusual timing, beacon-like patterns, or hosts that do not normally communicate externally.
  • Assess whether logging survives or reveals attempted indicator removal; absence of expected logs can itself become an investigation lead when correlated with endpoint activity.

Mitigation priorities

  • Strengthen third-party software and update-channel governance, including inventory, source validation, and rapid containment plans for trusted software compromise scenarios.
  • Ensure Windows endpoint detection and response coverage is deployed on high-value systems and configured to capture process, module, file, registry, and network activity needed for backdoor investigations.
  • Apply least-privilege and segmentation so a compromised Windows host has limited ability to discover sensitive systems or communicate broadly outbound.
  • Restrict and monitor unnecessary outbound DNS, web, file transfer, and other network protocols; require controlled egress paths where operationally feasible.
  • Maintain centralized, tamper-resistant logging and tested incident response playbooks for suspected backdoor activity, including memory, endpoint, and network triage.
Additional notes and limits

ShadowPad is described by ATT&CK as a modular backdoor first identified in the 2017 NetSarang supply chain compromise. ATT&CK relationships connect it to multiple groups and campaigns, including Indian Critical Infrastructure Intrusions, RedDelta Modified PlugX Infection Chain Operations, APT41, Mustang Panda, RedEcho, and others. The object’s platform is Windows, while several related techniques have broader platform listings; this take treats ShadowPad coverage as a Windows-focused validation exercise.

The supplied ATT&CK object has no official detection text, no aliases, and no object-level tactics specified. Relationship descriptions are partially truncated, and external reporting is referenced but not expanded beyond the supplied fields. Local telemetry, software inventory, geography, sector, and incident evidence are required before making exposure, compromise, or attribution judgments.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

ShadowPad

ShadowPad is a modular backdoor that was first identified in a supply chain compromise of the NetSarang software in mid-July 2017. The malware was originally thought to be exclusively used by APT41, but has since been observed to be used by various Chinese threat activity groups. [1][2][3]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

21 rows
DomainIDNameRelationship / procedure
EnterpriseT1033System Owner/User Discovery

ShadowPad has collected the username of the victim system.[3]

EnterpriseT1112Modify Registry

ShadowPad can modify the Registry to store and maintain a configuration block and virtual file system.[3][4]

EnterpriseT1124System Time Discovery

ShadowPad has collected the current date and time of the victim system.[3]

EnterpriseT1070Indicator Removal

ShadowPad has deleted arbitrary Registry values.[3]

EnterpriseT1140Deobfuscate/Decode Files or Information

ShadowPad has decrypted a binary blob to start execution.[3]

EnterpriseT1027.011Fileless StorageSub-technique

ShadowPad maintains a configuration block and virtual file system in the Registry.[3][4]

EnterpriseT1016System Network Configuration Discovery

ShadowPad has collected the domain name of the victim system.[3]

EnterpriseT1029Scheduled Transfer

ShadowPad has sent data back to C2 every 8 hours.[2]

EnterpriseT1057Process Discovery

ShadowPad has collected the PID of a malicious process.[3]

EnterpriseT1071.004DNSSub-technique

ShadowPad has used DNS tunneling for C2 communications.[3]

EnterpriseT1132.002Non-Standard EncodingSub-technique

ShadowPad has encoded data as readable Latin characters.[2]

EnterpriseT1071.002File Transfer ProtocolsSub-technique

ShadowPad has used FTP for C2 communications.[3]

EnterpriseT1095Non-Application Layer Protocol

ShadowPad has used UDP for C2 communications.[3]

EnterpriseT1027Obfuscated Files or Information

ShadowPad has encrypted its payload, a virtual file system, and various files.[2][4]

EnterpriseT1071.001Web ProtocolsSub-technique

ShadowPad communicates over HTTP to retrieve a string that is decoded into a C2 server URL.[3]

EnterpriseT1055Process Injection

ShadowPad has injected an install module into a newly created process.[3]

EnterpriseT1082System Information Discovery

ShadowPad has discovered system information including memory status, CPU frequency, and OS versions.[3]

EnterpriseT1680Local Storage Discovery

ShadowPad has discovered system information including volume serial numbers.[3]

EnterpriseT1568.002Domain Generation AlgorithmsSub-technique

ShadowPad uses a DGA that is based on the day of the month for C2 servers.[2][3][11]

EnterpriseT1105Ingress Tool Transfer

ShadowPad has downloaded code from a C2 server.[2]

EnterpriseT1055.001Dynamic-link Library InjectionSub-technique

ShadowPad has injected a DLL into svchost.exe.[3]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0129: Mustang Panda

Mustang Panda is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. Mustang Panda has been known to use tailored phishing lures and decoy documents to deliver malicious payloads. Mustang Panda has targeted government, diplomatic, and non-governmental organizations, including think tanks, religious institutions, and research entities, across the United States, Europe, and Asia, with notable activity in Russia, Mongolia, Myanmar, Pakistan, and Vietnam. [1][2][3][4][5][6][7][8][9][10][11][12][13]

GroupEnterprise

G1042: RedEcho

RedEcho is a People’s Republic of China-related threat actor associated with long-running intrusions in Indian critical infrastructure entities. RedEcho overlaps with various other PRC-linked threat groups, such as APT41, and is linked to ShadowPad malware use through shared infrastructure.[1][2]

GroupEnterprise

G0081: Tropic Trooper

Tropic Trooper is an unaffiliated threat group that has led targeted campaigns against targets in Taiwan, the Philippines, and Hong Kong. Tropic Trooper focuses on targeting government, healthcare, transportation, and high-tech industries and has been active since 2011.[1][2][3]

GroupEnterprise

G0131: Tonto Team

Tonto Team is a suspected Chinese state-sponsored cyber espionage threat group that has primarily targeted South Korea, Japan, Taiwan, and the United States since at least 2009; by 2020 they expanded operations to include other Asian as well as Eastern European countries. Tonto Team has targeted government, military, energy, mining, financial, education, healthcare, and technology organizations, including through the Heartbeat Campaign (2009-2012) and Operation Bitter Biscuit (2017).[1][2][3][4][5][6]

GroupEnterprise

G0096: APT41

APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries.[1] Notable behaviors include using a wide range of malware and tools to complete mission objectives. APT41 overlaps at least partially with public reporting on groups including BARIUM and Winnti Group.[2][3]

GroupEnterprise

G0143: Aquatic Panda

Aquatic Panda is a suspected China-based threat group with a dual mission of intelligence collection and industrial espionage. Active since at least May 2020, Aquatic Panda has primarily targeted entities in the telecommunications, technology, and government sectors.[1]

GroupEnterprise

G1006: Earth Lusca

Earth Lusca is a suspected China-based cyber espionage group that has been active since at least April 2019. Earth Lusca has targeted organizations in Australia, China, Hong Kong, Mongolia, Nepal, the Philippines, Taiwan, Thailand, Vietnam, the United Arab Emirates, Nigeria, Germany, France, and the United States. Targets included government institutions, news media outlets, gambling companies, educational institutions, COVID-19 research organizations, telecommunications companies, religious movements banned in China, and cryptocurrency trading platforms; security researchers assess some Earth Lusca operations may be financially motivated.[1]

Earth Lusca has used malware commonly used by other Chinese threat groups, including APT41 and the Winnti Group cluster, however security researchers assess Earth Lusca's techniques and infrastructure are separate.[1]

GroupEnterprise

G0060: BRONZE BUTLER

BRONZE BUTLER is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group primarily targets Japanese organizations, particularly those in government, biotechnology, electronics manufacturing, and industrial chemistry.[1][2][3]

CampaignEnterprise

C0043: Indian Critical Infrastructure Intrusions

Indian Critical Infrastructure Intrusions is a sequence of intrusions from 2021 through early 2022 linked to People’s Republic of China (PRC) threat actors, particularly RedEcho and Threat Activity Group 38 (TAG38). The intrusions appear focused on IT system breach in Indian electric utility entities and logistics firms, as well as potentially managed service providers operating within India. Although focused on OT-operating entities, there is no evidence this campaign was able to progress beyond IT breach and information gathering to OT environment access.[1][2]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1112: Modify RegistryEnterpriseuses · TechniqueT1124: System Time DiscoveryEnterpriseuses · TechniqueT1070: Indicator RemovalEnterpriseuses · CampaignC0047: RedDelta Modified PlugX Infection Chain OperationsEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · GroupG0129: Mustang PandaEnterpriseuses · TechniqueT1027.011: Fileless StorageEnterpriseuses · CampaignC0043: Indian Critical Infrastructure IntrusionsEnterpriseuses · GroupG1042: RedEchoEnterpriseuses · GroupG0081: Tropic TrooperEnterpriseuses · GroupG0131: Tonto TeamEnterpriseuses · GroupG0096: APT41Enterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1029: Scheduled TransferEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1071.004: DNSEnterpriseuses · TechniqueT1132.002: Non-Standard EncodingEnterpriseuses · TechniqueT1071.002: File Transfer ProtocolsEnterpriseuses · TechniqueT1095: Non-Application Layer ProtocolEnterpriseuses · TechniqueT1027: Obfuscated Files or InformationEnterpriseuses · GroupG0143: Aquatic PandaEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1055: Process InjectionEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.3
Created
Modified
Raw hash
d8ce46c5a7bbd4fd...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.3Current bundled8ce46c5a7bb…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Recorded Future RedEcho Feb 2021

    Insikt Group. (2021, February 28). China-Linked Group RedEcho Targets the Indian Power Sector Amid Heightened Border Tensions. Retrieved March 22, 2021.

    Open source URL
  2. [2]
    Securelist ShadowPad Aug 2017

    GReAT. (2017, August 15). ShadowPad in corporate networks. Retrieved March 22, 2021.

    Open source URL
  3. [3]
    Kaspersky ShadowPad Aug 2017

    Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.

    Open source URL
  4. [4]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  5. [5]
    Recorded Future RedDelta 2025

    Insikt Group. (2025, January 9). Chinese State-Sponsored RedDelta Targeted Taiwan, Mongolia, and Southeast Asia with Adapted PlugX Infection Chain. Retrieved January 14, 2025.

    Open source URL
  6. [6]
    Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023

    Lior Rochberger, Tom Fakterman, Robert Falcone. (2023, September 22). Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda. Retrieved September 9, 2025.

    Open source URL
  7. [7]
    RecordedFuture RedEcho 2022

    Recorded Future Insikt Group. (2022, April 6). Continued Targeting of Indian Power Grid Assets by Chinese State-Sponsored Activity Group. Retrieved November 21, 2024.

    Open source URL
  8. [8]
    Dragos YIR 2021

    Dragos. (2022). 2021 ICS Cybersecurity Year in Review. Retrieved November 21, 2024.

    Open source URL
  9. [9]
    RecordedFuture RedEcho 2021

    Recorded Future Insikt Group. (2021, February). China-Linked Group RedEcho Targets the Indian Power Sector Amid Heightened Border Tensions. Retrieved November 21, 2024.

    Open source URL
  10. [10]
    Kaspersky CactusPete Aug 2020

    Zykov, K. (2020, August 13). CactusPete APT group’s updated Bisonal backdoor. Retrieved May 5, 2021.

    Open source URL
  11. [11]
    FireEye APT41 Aug 2019

    Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.

    Open source URL
  12. [12]
    Crowdstrike HuntReport 2022

    CrowdStrike. (2023). 2022 Falcon OverWatch Threat Hunting Report. Retrieved May 20, 2024.

    Open source URL
  13. [13]
    FireEye APT41 Aug 2019

    Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.

    Open source URL
  14. [14]
    FireEye APT41 Aug 2019

    Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.

    Open source URL
  15. [15]
    Kaspersky ShadowPad Aug 2017

    Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.

    Open source URL
  16. [16]
    Kaspersky ShadowPad Aug 2017

    Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.

    Open source URL
  17. [17]
    POISONPLUG.SHADOW

    (Citation: FireEye APT41 Aug 2019)

  18. [18]
    POISONPLUG.SHADOW

    (Citation: FireEye APT41 Aug 2019)

  19. [19]
    POISONPLUG.SHADOW

    (Citation: FireEye APT41 Aug 2019)

  20. [20]
    Recorded Future RedEcho Feb 2021

    Insikt Group. (2021, February 28). China-Linked Group RedEcho Targets the Indian Power Sector Amid Heightened Border Tensions. Retrieved March 22, 2021.

    Open source URL
  21. [21]
    Recorded Future RedEcho Feb 2021

    Insikt Group. (2021, February 28). China-Linked Group RedEcho Targets the Indian Power Sector Amid Heightened Border Tensions. Retrieved March 22, 2021.

    Open source URL
  22. [22]
    Securelist ShadowPad Aug 2017

    GReAT. (2017, August 15). ShadowPad in corporate networks. Retrieved March 22, 2021.

    Open source URL
  23. [23]
    Securelist ShadowPad Aug 2017

    GReAT. (2017, August 15). ShadowPad in corporate networks. Retrieved March 22, 2021.

    Open source URL
  24. [24]
    mitre-attackS0596
    Open source URL
  25. [25]
    mitre-attackS0596
    Open source URL
  26. [26]
    mitre-attackS0596
    Open source URL
  27. [27]
    Kaspersky ShadowPad Aug 2017

    Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.

    Open source URL
  28. [28]
    Kaspersky ShadowPad Aug 2017

    Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.

    Open source URL
  29. [29]
    Kaspersky ShadowPad Aug 2017

    Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.

    Open source URL
  30. [30]
    Kaspersky ShadowPad Aug 2017

    Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.

    Open source URL
  31. [31]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  32. [32]
    Kaspersky ShadowPad Aug 2017

    Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.

    Open source URL
  33. [33]
    Kaspersky ShadowPad Aug 2017

    Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.

    Open source URL
  34. [34]
    Kaspersky ShadowPad Aug 2017

    Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.

    Open source URL
  35. [35]
    Kaspersky ShadowPad Aug 2017

    Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.

    Open source URL
  36. [36]
    Recorded Future RedDelta 2025

    Insikt Group. (2025, January 9). Chinese State-Sponsored RedDelta Targeted Taiwan, Mongolia, and Southeast Asia with Adapted PlugX Infection Chain. Retrieved January 14, 2025.

    Open source URL
  37. [37]
    Kaspersky ShadowPad Aug 2017

    Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.

    Open source URL
  38. [38]
    Kaspersky ShadowPad Aug 2017

    Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.

    Open source URL
  39. [39]
    Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023

    Lior Rochberger, Tom Fakterman, Robert Falcone. (2023, September 22). Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda. Retrieved September 9, 2025.

    Open source URL
  40. [40]
    Kaspersky ShadowPad Aug 2017

    Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.

    Open source URL
  41. [41]
    Kaspersky ShadowPad Aug 2017

    Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.

    Open source URL
  42. [42]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  43. [43]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  44. [44]
    Dragos YIR 2021

    Dragos. (2022). 2021 ICS Cybersecurity Year in Review. Retrieved November 21, 2024.

    Open source URL
  45. [45]
    RecordedFuture RedEcho 2022

    Recorded Future Insikt Group. (2022, April 6). Continued Targeting of Indian Power Grid Assets by Chinese State-Sponsored Activity Group. Retrieved November 21, 2024.

    Open source URL
  46. [46]
    RecordedFuture RedEcho 2021

    Recorded Future Insikt Group. (2021, February). China-Linked Group RedEcho Targets the Indian Power Sector Amid Heightened Border Tensions. Retrieved November 21, 2024.

    Open source URL
  47. [47]
    RecordedFuture RedEcho 2022

    Recorded Future Insikt Group. (2022, April 6). Continued Targeting of Indian Power Grid Assets by Chinese State-Sponsored Activity Group. Retrieved November 21, 2024.

    Open source URL
  48. [48]
    RecordedFuture RedEcho 2022

    Recorded Future Insikt Group. (2022, April 6). Continued Targeting of Indian Power Grid Assets by Chinese State-Sponsored Activity Group. Retrieved November 21, 2024.

    Open source URL
  49. [49]
    Recorded Future RedEcho Feb 2021

    Insikt Group. (2021, February 28). China-Linked Group RedEcho Targets the Indian Power Sector Amid Heightened Border Tensions. Retrieved March 22, 2021.

    Open source URL
  50. [50]
    Recorded Future RedEcho Feb 2021

    Insikt Group. (2021, February 28). China-Linked Group RedEcho Targets the Indian Power Sector Amid Heightened Border Tensions. Retrieved March 22, 2021.

    Open source URL
  51. [51]
    Kaspersky CactusPete Aug 2020

    Zykov, K. (2020, August 13). CactusPete APT group’s updated Bisonal backdoor. Retrieved May 5, 2021.

    Open source URL
  52. [52]
    FireEye APT41 Aug 2019

    Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.

    Open source URL
  53. [53]
    FireEye APT41 Aug 2019

    Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.

    Open source URL
  54. [54]
    Recorded Future RedEcho Feb 2021

    Insikt Group. (2021, February 28). China-Linked Group RedEcho Targets the Indian Power Sector Amid Heightened Border Tensions. Retrieved March 22, 2021.

    Open source URL
  55. [55]
    Recorded Future RedEcho Feb 2021

    Insikt Group. (2021, February 28). China-Linked Group RedEcho Targets the Indian Power Sector Amid Heightened Border Tensions. Retrieved March 22, 2021.

    Open source URL
  56. [56]
    Kaspersky ShadowPad Aug 2017

    Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.

    Open source URL
  57. [57]
    Kaspersky ShadowPad Aug 2017

    Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.

    Open source URL
  58. [58]
    Securelist ShadowPad Aug 2017

    GReAT. (2017, August 15). ShadowPad in corporate networks. Retrieved March 22, 2021.

    Open source URL
  59. [59]
    Securelist ShadowPad Aug 2017

    GReAT. (2017, August 15). ShadowPad in corporate networks. Retrieved March 22, 2021.

    Open source URL
  60. [60]
    Kaspersky ShadowPad Aug 2017

    Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.

    Open source URL
  61. [61]
    Kaspersky ShadowPad Aug 2017

    Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.

    Open source URL
  62. [62]
    Kaspersky ShadowPad Aug 2017

    Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.

    Open source URL
  63. [63]
    Kaspersky ShadowPad Aug 2017

    Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.

    Open source URL
  64. [64]
    Securelist ShadowPad Aug 2017

    GReAT. (2017, August 15). ShadowPad in corporate networks. Retrieved March 22, 2021.

    Open source URL
  65. [65]
    Securelist ShadowPad Aug 2017

    GReAT. (2017, August 15). ShadowPad in corporate networks. Retrieved March 22, 2021.

    Open source URL
  66. [66]
    Kaspersky ShadowPad Aug 2017

    Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.

    Open source URL
  67. [67]
    Kaspersky ShadowPad Aug 2017

    Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.

    Open source URL
  68. [68]
    Kaspersky ShadowPad Aug 2017

    Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.

    Open source URL
  69. [69]
    Kaspersky ShadowPad Aug 2017

    Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.

    Open source URL
  70. [70]
    Securelist ShadowPad Aug 2017

    GReAT. (2017, August 15). ShadowPad in corporate networks. Retrieved March 22, 2021.

    Open source URL
  71. [71]
    Securelist ShadowPad Aug 2017

    GReAT. (2017, August 15). ShadowPad in corporate networks. Retrieved March 22, 2021.

    Open source URL
  72. [72]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  73. [73]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  74. [74]
    Crowdstrike HuntReport 2022

    CrowdStrike. (2023). 2022 Falcon OverWatch Threat Hunting Report. Retrieved May 20, 2024.

    Open source URL
  75. [75]
    Kaspersky ShadowPad Aug 2017

    Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.

    Open source URL
  76. [76]
    Kaspersky ShadowPad Aug 2017

    Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.

    Open source URL
  77. [77]
    Kaspersky ShadowPad Aug 2017

    Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.

    Open source URL
  78. [78]
    Kaspersky ShadowPad Aug 2017

    Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.

    Open source URL
  79. [79]
    Kaspersky ShadowPad Aug 2017

    Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.

    Open source URL
  80. [80]
    Kaspersky ShadowPad Aug 2017

    Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.

    Open source URL
  81. [81]
    Kaspersky ShadowPad Aug 2017

    Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.

    Open source URL
  82. [82]
    Kaspersky ShadowPad Aug 2017

    Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.

    Open source URL
  83. [83]
    FireEye APT41 Aug 2019

    Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.

    Open source URL
  84. [84]
    Kaspersky ShadowPad Aug 2017

    Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.

    Open source URL
  85. [85]
    Securelist ShadowPad Aug 2017

    GReAT. (2017, August 15). ShadowPad in corporate networks. Retrieved March 22, 2021.

    Open source URL
  86. [86]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  87. [87]
    Securelist ShadowPad Aug 2017

    GReAT. (2017, August 15). ShadowPad in corporate networks. Retrieved March 22, 2021.

    Open source URL
  88. [88]
    Recorded Future RedEcho Feb 2021

    Insikt Group. (2021, February 28). China-Linked Group RedEcho Targets the Indian Power Sector Amid Heightened Border Tensions. Retrieved March 22, 2021.

    Open source URL
  89. [89]
    Kaspersky ShadowPad Aug 2017

    Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use