ShadowPad:
the Masterpiece of Privately Sold Malware
in Chinese Espionage

Yi-Jhen Hsieh, Joey Chen

© 2021 SentinelOne. All Rights Reserved.

Yi-Jhen Hsieh
Threat Intelligence Researcher @SentinelOne

Joey Chen
Threat Intelligence Researcher @SentinelOne© 2021 SentinelOne. All Rights Reserved.

© 2021 SentinelOne. All Rights Reserved.

Outline▪

From PlugX to ShadowPad: the history▪

Technical overview▪

The business model of ShadowPad▪

Which threat actors are using ShadowPad?

▪

Landscape shift: from developing backdoors to acquiring backdoors▪

Mitigation advice© 2021 SentinelOne. All Rights Reserved.

From PlugX toShadowPad:
the history© 2021 SentinelOne. All Rights Reserved.

What is ShadowPad?
A modular backdoor in shellcode format.
▪ The plugins can be plugged or unplugged remotely during runtime.
▪

▪

It is used in several well-known campaigns as the primary backdoor for intrusion.

© 2021 SentinelOne. All Rights Reserved.

Which threat actors are using ShadowPad?
ShadowHammer

NetSarang
JP JAXACCleaner

WINNTI/APT41

Tick and Tonto TeamFishmonger

Tropic TrooperOperation Redbonus

Operation Redkanku© 2021 SentinelOne. All Rights Reserved.

LuckyMouse

ShadowPad: A successor to PlugX?
ShadowPadPlugX

Shellcode

Yes

Yes

Plugin-based

Yes

Yes

Remote plugin
management

Yes

No

Privately shared

Widely used

Distribution© 2021 SentinelOne. All Rights Reserved.

7

ShadowPad: A successor to PlugX? (cont.)▪

The relationship between ShadowPad and PlugX
Comparisons on their codes have been discussed[1]– They share the same project name “SC” according to the PDB strings of their controllers–••

PlugX Controller: D:\My2014\SController(5.6)(天道)(匙)\SC\ShadowPad Controller: X:\My2015\SC(1.1)\x64\Release\SoSvr.pdb[1] https://st.drweb.com/static/new-www/news/2020/october/Study_of_the_ShadowPad_APT_backdoor_and_its_relation_to_PlugX_en.pdf© 2021 SentinelOne. All Rights Reserved.

8

The alleged author of PlugX: whg
whg aka 无花果, based in the Sichuan province of China▪ His nickname was found in some of the PlugX samples[2]:▪

C:\Documents and Settings\whg\桌面\Plug\FastGui(LYT)\Shell\Release\Shell.pdb– C:\Users\whg\Desktop\Plug\FastGui(LYT)\Shell\Release\Shell.pdb–▪

He had a solid track record of developing backdoors and hacking tools, while he claimed
to sell some “shared software”.
–Also, he had deep connection with Rose,one of the threat actors in APT41.

[2] https://cybersecurity.att.com/blogs/labs-research/tracking-down-the-author-of-the-plugx-rat© 2021 SentinelOne. All Rights Reserved.

9

Technical overview© 2021 SentinelOne. All Rights Reserved.

The modular design© 2021 SentinelOne. All Rights Reserved.

11

The shellcode loader© 2021 SentinelOne. All Rights Reserved.

12

The plugins
Every plugin is decrypted, loaded into memory, and referenced in a LinkedList.
▪ Additional plugins could be uploaded from the C&C servers.
▪

struct plugin_node {plugin_node* previous_node;plugin_node* next_node;
DWORD referenced_count;
DWORD plugin_timestamp;
DWORD plugin_id;
DWORD field_0;
DWORD field_1;
DWORD field_2;
DWORD field_3;
DWORD plugin_size;
LPVOID plugin_base_addr;
LPVOID plugin_export_function_table_addr;}© 2021 SentinelOne. All Rights Reserved.

13

The start function of a plugin

▪
▪
▪
▪
▪

0x01: Setup the export function table of the plugin
0x64: Setup the plugin
0x66: Return the plugin ID
0x67: Return the plugin name
0x68: Return the address of the export function table© 2021 SentinelOne. All Rights Reserved.

14

22 unique plugins
Basic Set•
••
•
•
•
•
•
•

Root
Plugins
Config
InstallOnline
TCP
HTTP
UDP
DNS

Utilities
••
•
•
•
•
•
•
•

ImpUser
PIPE
Disk
Process
Servcie
Register
Shell
PortMap
Keylogger© 2021 SentinelOne. All Rights Reserved.

••••

ScreenSoftwareHardwareRecentFiles

15

The configuration
OffsetData Type

Column0x00

WORDoffset_product_key

0x02

WORD

offset_note

0x04

WORD

offset_binary_path

0x06

WORD

offset_service_name (default: MyTest)

0x08

WORD

offset_service_display_name (default: MyTest)

0x0A

WORD

offset_service_description (default: MyTest)

0x0C

WORD

offset_registry_key

0x0E

WORD

offset_registry_value

0x10 - 0x17

WORD

offset_process_spawn_and_inject 1-4

0x18 - 0x37

WORD

offset_c2 1-16

0x38 - 0x3F

WORDoffset_proxy_type 1-40x40 - 0x4F

DWORD

DNS 1-40x50

DWORD

timeout_multiplier© 2021 SentinelOne. All Rights Reserved.

16

New version: the infection chain▪

First found in 2020 by PT security[3]DLL side-loading

log.exe
legitimate executable

reads and decrypts

log.dllobfuscated loader

log.datencrypted payload[3] https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/#id6© 2021 SentinelOne. All Rights Reserved.

17

New version, more obfuscation
First found in 2020 by PT security[3]▪ The control flow is flattened by instruction▪

© 2021 SentinelOne. All Rights Reserved.

18

The configuration of the new version
OffsetData Type

Column0x00

WORDoffset_date (product key)

0x02

WORD

offset_note

0x04

WORD

offset_install_directory

0x06

WORD

offset_executable_name

0x08

WORD

offset_loader_name

0x0A

WORD

offset_payload_name

0x0C

WORD

offset_service_name

0x0E

WORD

offset_service_display_name

0x10

WORD

offset_service_description

0x12

WORD

offset_reg_key

0x14

WORDoffset_reg_value

0x16 - 0x1D

WORD

offset_process_spawn_and_inject 1-40x1E - 0x4F

WORD

offset_c2 1-160x50 - 0x57

WORD

offset_proxy_type 1-40x58 - 0x67

DWORD

DNS 1-40x68

DWORD

timeout_multiplier© 2021 SentinelOne. All Rights Reserved.

19

The controller
Version 1.0, 2015
▪ Written in Delphi▪ All-in-one:builder + C&C listener▪

© 2021 SentinelOne. All Rights Reserved.

20

The management console
Default plugins v.s. uploaded plugins▪ The control pages of the plugins are fixed▪

© 2021 SentinelOne. All Rights Reserved.

21

The builder
Campaign code
▪ Notes▪ Anti-debugger settings▪ Installation settings(service and registry)▪ Process injection settings▪ C&C servers▪ Connection modes▪

© 2021 SentinelOne. All Rights Reserved.

22

The business modelof ShadowPad© 2021 SentinelOne. All Rights Reserved.

How flexible is the controller?
The plugins are place in a directory.
▪ In theory, you can upload any plugin within thecorrect format.
▪

© 2021 SentinelOne. All Rights Reserved.

24

How flexible is the controller?
▪

… but the user cannot interact withthe plugins without an interface
The interfaces are hardcoded in thecontroller– No options to add a new interface–© 2021 SentinelOne. All Rights Reserved.

25

A piece of sold malware with extendibility▪

ShadowPad is not extendible by the users except the original developer.
–▪

Not originally designed as a framework.

The developer can remove a plugin from the package easily.
–

Just remove the plugins from the directory.

© 2021 SentinelOne. All Rights Reserved.

26

Selling the plugins separately
Basic set: Root, Plugins, Config, Install, Online, TCP, HTTP, UDP, DNS© 2021 SentinelOne. All Rights Reserved.

27

Selling the plugins separately
A special version: packed by VMProtect, different plugin IDs© 2021 SentinelOne. All Rights Reserved.

28

Selling the plugins separately
With utility plugins embedded© 2021 SentinelOne. All Rights Reserved.

29

Selling the plugins separately (cont.)▪

Most of the samples do not have utility plugins embedded in them.
Need to upload other plugins remotely through the controllers.
– The plugins are placed in the directory:easy to be removed from a package–▪

Tick – an active user of ShadowPad – developed a tool with the same functionality of theplugin “Software” in an overlapped timeframe.
–▪

Tick did not have access to that plugin while it was already available

The plugins should be provided separately.
–Not given in a full bundle.

© 2021 SentinelOne. All Rights Reserved.

30

The business model of ShadowPad
ShadowPad is a sold malware.
▪ The plugins need to be acquired separately.
▪ It is only sold to a limited set of users.
▪

▪

Why is ShadowPad a good choice for the attackers:
The cost to develop a stable backdoor/RAT is high.
– The plugins (functionalities) are complete, and the attackers can choose which they want.
–•–

ShadowPad was the primary backdoor for long-term espionage in several campaigns.

The use of a shared backdoor reduces the chance to be attributed.

© 2021 SentinelOne. All Rights Reserved.

31

Which threat actors
are using
ShadowPad?

© 2021 SentinelOne. All Rights Reserved.

Which threat actors are using ShadowPad?

WINNTI/APT41

Operation Redbonus

Fishmonger

Tropic Trooper
Tick and Tonto Team

Operation Redkanku© 2021 SentinelOne. All Rights Reserved.

LuckyMouse
33

WINNTI/APT41
Two sub-groups of WINNTI/APT41§

BARIUM (Tan Dailin aka Roseand Zhang Haoran)–§Against the gaming industry and several
supply chain attacks, e.g., NetSarang,
ASUS, and allegedly, CCleaner

LEAD (Chengdu 404
Network Technology Co., Ltd)–

Attack for financial andespionage purposes© 2021 SentinelOne. All Rights Reserved.

34

What is NCPH
A hacking group that developed lots oftools and freely shared on NCPH
websites
They also declared that the sourcecode was on sale
▪ Rose and whg have collaboration onmalware development since 2006▪

Rose likely had high privilege access – orwas a co-developer – to ShadowPad© 2021 SentinelOne. All Rights Reserved.

35

Tick and Tonto Team
Two groups amalgamated into a new
institution during the reorganization of PLA▪ Started to use ShadowPad as their primary
backdoor for conducting intrusion▪ TICK▪

–▪

Sent spear phishing emails to deliver
ShadowPad

Tonto Team–Exploited CVE-2019-9489 and CVE-2020-8468
in Trend Micro’s security solutions to deliver
ShadowPad© 2021 SentinelOne. All Rights Reserved.

36

Customized tools for intrusion
Customized tools▪ Modified mimikatz▪ Screen capture tool
▪ Packet transmission tool
▪ Tool to list the software installed on a computer–▪

ShadowPad has a plugin with the same functionality

VBScript command executor tool
Generate a payload of VBScript– Bypass TrendMicro products–© 2021 SentinelOne. All Rights Reserved.

37

Operation Redbonus§

Against Indian country§

Other backdoors in use, suchas Whitebird, IceFog and acustomized instance of PCShare© 2021 SentinelOne. All Rights Reserved.

© 2021 SentinelOne. All Rights Reserved.

38

Operation Redkanku§

All of the C&C servers had aself-signed certificate§

Some related samples weredocumented to be a part of t
he ProxyLogon attacks© 2021 SentinelOne. All Rights Reserved.

© 2021 SentinelOne. All Rights Reserved.

Fishmonger§

New version of ShadowPad which had
updates and moreadvanced obfuscation techniques§

They are interested in COVID19 research in Hong Kong, Taiwan,
India and the US.

§ShadowPad and Spyder
as their primary backdoors forlong-term monitoring§

A self-signed certificate is installed
on several C&C servers ofShadowPad and Spyder© 2021 SentinelOne. All Rights Reserved.

© 2021 SentinelOne. All Rights Reserved.

Landscape shift© 2021 SentinelOne. All Rights Reserved.

From developing backdoors to acquiring backdoors
▪

Past–

▪

Chinese threat actors develop their own tool sets based on their needs during operations

Now
The popularity of malware such as ShadowPad and CobaltStrike among Chinese espionage
groups– Here is an example about Tick's timeline of backdoor–© 2021 SentinelOne. All Rights Reserved.

42

The benfit of acquiring backdoors▪

Lower the cost
Reduces the cost of a well-designed piece of malware– Reduces the human resource to develop the malware in-house–▪

Keeps enhancing the stability and usability
The service provider will provide newest version of the backdoor with new features added– Unlike much of the commodity malware found in cybercriminal circles or underground forums–© 2021 SentinelOne. All Rights Reserved.

43

Mitigation advice© 2021 SentinelOne. All Rights Reserved.

Mitigation advice for ShadowPad▪

Audit the services and the registries to find any suspicious items▪

Monitor dynamic behaviors of “spawning a new process” and “process injection”▪

Apply memory forensics periodically to identify malware which resides in-memory▪

Adopt an Endpoint Detection and Response (EDR) solution across your organization▪

A well consolidated monitoring capability provides visibility into cyber threats© 2021 SentinelOne. All Rights Reserved.

45

Conclusion© 2021 SentinelOne. All Rights Reserved.

Conclusion▪

Why do the actors choose to use ShadowPad?
Experienced developers to develop something much better with active updates– Reducing the cost of operation and development– Harder for security company to do further research–▪

Why ShadowPad is not disappearing?
Still under updates with more advanced obfuscation and persistence techniques– A powerful backdoor with more functionalities so good for long-term espionage operations andkeep stealthy under the radar–▪

How ShadowPad affect threat intelligence?
–

Need to develop more systematic ways for attribution© 2021 SentinelOne. All Rights Reserved.

47

Thank Yousentinelone.com© 2021 SentinelOne. All Rights Reserved.