Article
Software Shared Across ATT&CK Groups: Reuse Study
MITRE ATT&CK v19.2 data: Mimikatz is linked to 51 of 176 groups, while 503 of 607 software entries tie to one group. See the…
Read more
Malware profile
ShadowPad
Also known as POISONPLUG.SHADOW, PoisonPlug, Barlaiy
ShadowPad is a modular backdoor for Windows.
In short
ShadowPad is a modular backdoor for Windows. MITRE ATT&CK says it was first identified in a supply chain compromise of NetSarang software in mid-July 2017. MITRE also says it has since been seen in use by various Chinese threat activity groups.
- Names5names in public reportsShadowPad · POISONPLUG.SHADOW · PoisonPlug
- Techniques16ATT&CK techniques listedDiscovery · Stealth · Exfiltration
- Linked Groups2groups that use itAPT41 · Mustang Panda
In one minute
- What it is
- A modular backdoor for Windows, first identified in a supply chain compromise of NetSarang software in mid-July 2017.
- What it does
- Keeps its settings in the Windows Registry, talks to its command servers over HTTP, FTP, UDP and DNS, injects code into other processes, collects system details and downloads more code.
- Who uses it
- Attributed by the FBI, with CISA, on 16 September 2020: listed among malware used by a group tied to the APT 41 indictment. MITRE lists APT41, Mustang Panda and other groups; for Mustang Panda MITRE's citation is a vendor report, so treat that link as MITRE's view only.
- How it gets in
- MITRE records a supply chain compromise of legitimate software in 2017. CERT-EU reports a 2024 campaign that exploited CVE-2024-24919.
- What to do first
- Follow the FBI and CISA mitigations in alert AC-000133-TT: patch internet-facing servers and log and watch DNS queries for command traffic.
What it does
MITRE says ShadowPad was first thought to be used only by APT41. It says the malware has since been observed with various Chinese threat activity groups, so it is not tied to one actor.
The FBI, working with CISA, listed it in a September 2020 alert on the group behind the APT 41 indictment. The US court papers in that case name "Shadowpad" among the specialized malware the defendants used.
Names
Public sources use several names for this malware.
| Name | Where it appears |
|---|---|
| ShadowPad | MITRE ATT&CK software S0596, the FBI alert AC-000133-TT and the US indictment[1, 2, 3] |
| POISONPLUG.SHADOW | MITRE ATT&CK Associated Software[1] |
| PoisonPlug | Written "PoisonPlug/Barlaiy/ShadowPad" in the FBI alert AC-000133-TT[2] |
| Barlaiy | Written "Barlaiy/Poison Plug" in the US indictment and "PoisonPlug/Barlaiy/ShadowPad" in the FBI alert[2, 3] |
| Poison Plug | Written "Barlaiy/Poison Plug" in the US indictment[3] |
What it can do
What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.
Discovery
System Network Configuration Discovery T1016
It has collected the domain name of the victim system.[1]
System Owner/User Discovery T1033
It has collected the username of the victim system.[1]
System Information Discovery T1082
It has gathered memory status, CPU frequency and operating system versions.[1]
Stealth
Obfuscated Files or Information T1027
Its payload, a virtual file system and other files are encrypted.[1]
Obfuscated Files or Information: Fileless Storage T1027.011
It keeps a configuration block and a virtual file system in the Registry.[1]
Process Injection: Dynamic-link Library Injection T1055.001
It has injected a DLL into svchost.exe.[1]
Indicator Removal T1070
It has deleted arbitrary Registry values.[1]
Deobfuscate/Decode Files or Information T1140
It has decrypted a binary blob in order to start running.[1]
Command and Control
Application Layer Protocol: Web Protocols T1071.001
It uses HTTP to fetch a string that is decoded into a command server address.[1]
Application Layer Protocol: File Transfer Protocols T1071.002
It has used FTP for command traffic.[1]
Application Layer Protocol: DNS T1071.004
It has used DNS tunnelling for command traffic.[1]
Non-Application Layer Protocol T1095
It has used UDP for command traffic.[1]
Ingress Tool Transfer T1105
It has downloaded code from a command server.[1]
Dynamic Resolution: Domain Generation Algorithms T1568.002
It uses a domain generation algorithm, based on the day of the month, to pick command servers.[1]
How it spreads
MITRE says ShadowPad was first identified in a supply chain compromise of NetSarang software in mid-July 2017. CERT-EU describes the same event as a supply chain attack in which compromised NetSarang software packages carried the ShadowPad malware suite. MITRE says Mustang Panda used DLL sideloading to install ShadowPad in a 2023 to 2024 campaign. CERT-EU's February 2025 brief reports a campaign in which the flaw CVE-2024-24919 was exploited to deploy ShadowPad and PlugX.
Timeline
- mid-July 2017
- 16 September 2020
FBI and CISA alert on APT 41 indictment
The FBI, working with CISA, published alert AC-000133-TT on the US indictment of five China-based actors. It lists PoisonPlug/Barlaiy/ShadowPad among the malware used by the group.[2]
- 2020
US indictment names Shadowpad
The US District Court indictment (case 1:20-cr-00158) lists "Shadowpad" among specialized malware used by the defendants, whose activity cybersecurity experts tracked as APT41.[3]
- January 2021 to April 2022
Indian Critical Infrastructure Intrusions
MITRE records this campaign, linked to PRC threat actors, as including the use of ShadowPad.[9]
- July 2023 to December 2024
RedDelta campaign
MITRE says Mustang Panda used DLL sideloading to install ShadowPad during this campaign.[8]
- 18 February 2025
CERT-EU reports ransomware campaign
CERT-EU's February 2025 brief reports a campaign that exploited CVE-2024-24919 to deploy ShadowPad and PlugX, and later NailaoLocker ransomware. It says the activity is unattributed to a known group.[5]
Who uses it
- Threat group APT41 MITRE describes APT41 as a Chinese state-sponsored espionage group, as researchers have assessed it, that also runs financially motivated operations. China · Since 2012
- Threat group Mustang Panda MITRE ATT&CK describes Mustang Panda as a China-based cyber espionage threat actor, and the US Department of Justice, citing court documents, says the PRC government paid the group to develop a version of PlugX. China · Since 2012
Detection and defense
Patch and audit internet-facing systems
The FBI and CISA ask organizations to install verified patches, put internet-connected servers first, and use compensating controls where patching is not possible. They also advise routine audits of patch management.[2]
Questions
What is ShadowPad?
MITRE ATT&CK describes it as a modular backdoor for Windows that was first identified in a supply chain compromise of NetSarang software in mid-July 2017.
Who uses ShadowPad?
MITRE says it was first thought to be used only by APT41 but has been seen with various Chinese threat activity groups, and lists APT41 and Mustang Panda among others. The FBI, with CISA, listed it in 2020 among malware used by a group tied to the APT 41 indictment.
What other names does it have?
MITRE lists POISONPLUG.SHADOW. The FBI alert writes PoisonPlug/Barlaiy/ShadowPad, and the US indictment writes Barlaiy/Poison Plug.
How do defenders reduce the risk?
The FBI and CISA advise prompt patching of internet-connected servers, logging and monitoring DNS queries for command traffic, and using multi-factor authentication. Their alert is about the wider APT 41 group, not ShadowPad alone.
In our research
- Software Shared Across ATT&CK Groups: Reuse Study October 2026
- LIMINAL PANDA: China’s Emerging Espionage Threat in the Semiconductor and Technology Sectors February 2026
- APT41: China’s Dual-Purpose Cyber Powerhouse November 2025
- APT41 Threat group
- Mustang Panda Threat group
Sources
- ShadowPad, Software S0596 MITRE ATT&CKSupports: Description, first identification in 2017, alias, platform, techniques and groups.
- Indictment of China-Based Cyber Actors Associated with APT 41 for Intrusion Activities, Flash AC-000133-TT FBI with CISASupports: 16 September 2020 alert listing PoisonPlug/Barlaiy/ShadowPad among malware, plus mitigations.
- Indictment, United States v. Jiang Lizhi, Qian Chuan and Fu Qiang, case 1:20-cr-00158 US Department of JusticeSupports: Names "Shadowpad" among specialised malware used by the defendants, tracked as APT41.
- Threat Landscape Report, The 10 Years Edition CERT-EUSupports: Describes the ShadowPad supply chain attack through compromised NetSarang packages in 2017.
- Cyber Brief 25-03, February 2025 CERT-EUSupports: Campaign exploiting CVE-2024-24919 to deploy ShadowPad and PlugX.
- APT41, Group G0096 MITRE ATT&CKSupports: MITRE lists APT41 as a user of ShadowPad.
- Mustang Panda, Group G0129 MITRE ATT&CKSupports: MITRE lists Mustang Panda as a user of ShadowPad.
- RedDelta Modified PlugX Infection Chain Operations, Campaign C0047 MITRE ATT&CKSupports: Mustang Panda installed ShadowPad with DLL sideloading, July 2023 to December 2024.
- Indian Critical Infrastructure Intrusions, Campaign C0043 MITRE ATT&CKSupports: ShadowPad used in intrusions from January 2021 to April 2022.
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.