Chinese Hackers Turn Compromised Servers Into ShadowPad Nodes
A recent analysis by Check Point Research has uncovered that a Chinese threat actor, identified as Ink Dragon, has been exploiting a custom ShadowPad IIS Listener module to convert compromised servers into distributed relay nodes. This development marks…
A recent analysis by Check Point Research has uncovered that a Chinese threat actor, identified as Ink Dragon, has been exploiting a custom ShadowPad IIS Listener module to convert compromised servers into distributed relay nodes. This development marks a significant enhancement in the group's operational capabilities, facilitating a persistent and multi-layered command-and-control infrastructure that impacts victim organizations globally.
Ink Dragon, also known under various aliases such as Earth Alux and Jewelbug, has been actively targeting government, telecom, and public-sector infrastructures since early 2023. While initial operations were concentrated in Southeast Asia and South America, recent activities indicate a shift towards European government targets.
The ShadowPad IIS Listener module is central to the group's infrastructure strategy. By deploying this module across compromised servers, attackers create communication nodes that receive, forward, and proxy commands. This architecture allows traffic routing both within a single organization's network and across different victim networks, effectively integrating a single compromise into a global, multi-layered relay network.
The module operates by masquerading as legitimate IIS components, utilizing realistic configurations to blend into Windows Server installations. It intercepts specific HTTP requests while processing others as regular IIS traffic, maintaining operational stealth. Initial access is often gained through exploitation of known vulnerabilities, including ASP.NET ViewState deserialization attacks and SharePoint vulnerabilities.
While initial operations were concentrated in Southeast Asia and South America, recent activities indicate a shift towards European government targets.
The ShadowPad IIS module maintains two concurrent registries of peers: server and client lists. Nodes register into either category, with server entries revalidated every 30 seconds. Clients unpaired for 30 seconds are pruned to prevent stale links, facilitating sophisticated relay topology management.
The module leaves behind forensic artifacts, including debug strings that document data exchanges between IP addresses. It functions as both a relay network and a ShadowPad backdoor, enabling host reconnaissance, file operations, data collection, payload staging, and lateral movement. Ink Dragon's recent introduction of a new FinalDraft backdoor variant emphasizes enhanced stealth and exfiltration capabilities.
Forensic analysis of a compromised European government office details the attack chain: web-centric initial access, staged loaders, privilege escalation, credential harvesting, and domain dominance. To mitigate such threats, organizations should secure public-facing IIS and SharePoint servers, implement strong machine key management, and monitor for suspicious HTTP listener activity.
Based on reporting by GBHackers.