Possible supply chain attack targeting South Asian government delivers Shadowpad

Wednesday 4 October 14:00 - 14:30, Red room

Daniel Lunghi (Trend Micro)

Shadowpad is a malware family that has been involved in multiple advanced campaigns, starting in 2017 with a supply chain attack against NetSarang software, and an ASUS compromise in 2018, all attributed to APT41. Since 2019, multiple threat actors have been using this same malware family, making its attribution more difficult. For example, Earth Akhlut, a threat actor that we spoke about at Virus Bulletin in 2020, also uses it.

In this campaign, we noticed how a threat actor weaponized an application developed by a South Asian country to compromise some of its entities. The application is delivered to governmental entities only, with the purpose of improving their efficiency. However, the compromised version we found came with a Shadowpad payload, obfuscated with an unreported method.

In this presentation we will describe how the installer was modified to deliver the malicious payload. We will explain the multiple obfuscations we have seen for Shadowpad over the years, and what the differences are with this new version. We will show how it helped us to correlate this campaign with previous campaigns by the same threat actor. It also helped us find other Shadowpad samples from different threat actors, confirming that this is a shared malware family that is still being developed. We will also discuss some infrastructure reuse and quickly describe another malware family that seems more specific to a single threat actor. Finally, we plan to show some clever tricks that probably helped the attack to stay under the radar for a few months.

• Download slides for this talk
• Download paper for this talk

Daniel Lunghi Daniel Lunghi is a threat researcher at Trend Micro. He has been hunting malware and performing incident response investigations for years. Now he focuses on long-term monitoring of advanced threat actors from all over the world, exploring new ways of tracking them, and enjoying their mistakes. The results of such investigations are shared through blogposts, whitepapers and conference talks. @thehellu

Back to VB2023 Programme page

Back to VB2023 conference page

Register for VB2023

Other VB2023 papers