Chinese Hackers Using Custom ShadowPad IIS Listener Module to Turn Compromised Servers into Active Nodes
An advanced threat group has been identified using a custom ShadowPad IIS Listener module to transform compromised servers into a distributed relay network. This technique enables attackers to route malicious traffic through victim infrastructure,…
An advanced threat group has been identified using a custom ShadowPad IIS Listener module to transform compromised servers into a distributed relay network. This technique enables attackers to route malicious traffic through victim infrastructure, effectively converting compromised organizations into command-and-control nodes.
The operation exploits long-standing vulnerabilities, including ASP.NET ViewState deserialization and SharePoint flaws such as ToolShell. By leveraging leaked machine keys or unpatched endpoints , attackers can achieve remote code execution, leading to full-system compromise.
The malware establishes a covert channel that blends with legitimate web traffic, making detection difficult for network defenders monitoring standard protocols. Check Point analysts have identified this evolving threat cluster, known as Earth Alux or REF7707, noting significant refinement in its tradecraft.
Ink Dragon repurposes compromised systems not only for data theft but also to support ongoing operations against other targets. This creates a self-sustaining infrastructure that obscures the true origin of the attacks while maximizing the utility of every compromised asset.
The attackers utilize native IIS capabilities to intercept and relay communications, ensuring that command traffic remains hidden within standard HTTP streams. This strategic reuse of compromised assets reflects a mature operational philosophy focused on long-term stealth, resilience, and the continuous expansion of their operational reach.
The operation exploits long-standing vulnerabilities, including ASP.NET ViewState deserialization and SharePoint flaws such as ToolShell.
The core of this campaign involves a custom IIS module that differs from traditional backdoors. Instead of simply opening a port, it uses the HttpAddUrl API to register dynamic URL listeners that intercept specific HTTP requests.
When a request matches the configured pattern, the module decrypts the payload to determine if it is a command. If the traffic does not match the proprietary protocol, the module forwards it to the legitimate IIS worker, which serves normal web content to avoid raising suspicion.
The module utilizes a specific decryption routine to handle initial packets, ensuring that only authorized operator traffic is processed. By maintaining separate lists for server and client nodes, the malware automatically pairs connections to relay data between them. This enables attackers to bridge communications across unrelated victim networks, complicating attribution and remediation efforts.
def decrypt_first_packet(buf: bytearray, seed: int, length: int): count = length - 2 seed_lo = buf[0] seed_hi = buf[1] num = (seed_hi > 16) & 0xFFFF num = (hi 0x7093915D - num 0x6EA30000 + 0x06B0F0E3) & 0xFFFFFFFF buf[pos] ^= num & 0xFF pos += 1 return buf
This relay logic is supported by granular debug logging, which documents byte transfers and aids analysts in mapping the broader communication graph.
Based on reporting by Cyber Security News.