China-Aligned Attackers Use ShadowPad, IOX Proxy, and WMIC in Multi-Stage Espionage Campaign

China-Aligned Attackers Use ShadowPad, IOX Proxy, and WMIC in Multi-Stage Espionage Campaign

A new multi-stage espionage campaign targeting organizations worldwide has been attributed to a group aligned with Chinese interests. The campaign leverages sophisticated malware including ShadowPad, IOX Proxy, and WMIC (Windows Management Instrumentation Command-line) to infiltrate networks, establish persistence, and exfiltrate sensitive data.

Overview of the Campaign

• Targeted Organizations: Various organizations across different sectors.
• Primary Malware: ShadowPad, IOX Proxy
• Infection Vector: Exploitation of vulnerabilities like ProxyLogon in Microsoft Exchange/IIS servers.
• Persistence Mechanism: Scheduled tasks and registry keys.

Infection Process: How ShadowPad is Loaded

The attackers use a technique called DLL sideloading, where they place a malicious DLL alongside legitimate signed executables. When the legitimate program runs, it loads the malicious DLL instead. This method allows the attackers to blend in with normal system activity by renaming and disguising their payloads.

• Legitimate Executables Abused:
  • Toshiba
  • Samsung
  • Microsoft

ShadowPad's Stealth

Read the full article at Cyber Security News

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.