Threat actorhigh
APT41 likely compromised Taiwanese government-affiliated research institute with ShadowPad and Cobalt Strike
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2018-0824 | Deserialization of Untrusted Data RCE in Microsoft COM for Windows | 8.8 | 73% | KEVPoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | chatgptsfit.com | e ShadowPad payload connects to an interesting C2 domain w2.chatgptsfit[.]com for communication. Coverage Cisco Secure Endpoint (former |
| domain | www.nss.com | ownload Cobalt Strike malware from a compromised C2 server (www.nss.com[.]tw). The Cobalt Strike malware had been developed using a |
| ipv4 | 103.56.114.69 | rlapping: Beside the binary connection, we also found a C2 (103.56.114[.]69) that was reported by Symantec . Although the campaign re |
| ipv4 | 103.96.131.84 | f the loaders were observed downloaded from two C2 servers: 103.96.131[.]84 58.64.204[.]145 Beside the ShadowPad loader, we found the |
| ipv4 | 45.85.76.18 | ke beacon configuration shown below. { "C2Server" : "http://45.85.76.18:443/yPc1" , "User Agent" : "User-Agent: Mozilla/4.0 (compat |
| ipv4 | 58.64.204.145 | re observed downloaded from two C2 servers: 103.96.131[.]84 58.64.204[.]145 Beside the ShadowPad loader, we found the same Bitdefende |
| md5 | 978ece20137baea2bcb364b160eb9678 | d 2 other ShadowPad loaders by pivoting the RICH PE header (978ece20137baea2bcb364b160eb9678) of the ShadowPad loader. Sharing the same RICH PE header i |
| sha256 | 2e46fcadacfe9e2a63cfc18d95d5870de8b3414462bf14ba9e7c517678f235c9 | hat these binaries share a similar compilation environment. 2e46fcadacfe9e2a63cfc18d95d5870de8b3414462bf14ba9e7c517678f235c9 eba3138d0f3d2385b55b08d8886b1018834d194440691d33d612402ba8a |
| sha256 | 386eb7aa33c76ce671d6685f79512597f1fab28ea46c8ec7d89e58340081e2bd | the ShadowPad loader, we found the same Bitdefender loader (386eb7aa33c76ce671d6685f79512597f1fab28ea46c8ec7d89e58340081e2bd) and a payload file on the C2 server. The ShadowPad payload |
| sha256 | eba3138d0f3d2385b55b08d8886b1018834d194440691d33d612402ba8a11d28 | cadacfe9e2a63cfc18d95d5870de8b3414462bf14ba9e7c517678f235c9 eba3138d0f3d2385b55b08d8886b1018834d194440691d33d612402ba8a11d28 One of the loaders were observed downloaded from two C2 ser |
From the original article
11 min read at blog.talosintelligence.com
Cisco Talos discovered a malicious campaign that compromised a Taiwanese government-affiliated research institute that started as early as July 2023, delivering the ShadowPad malware, Cobalt Strike and other customized tools for post-compromise activities. The activity conducted on the victim endpoint matches the hacking group APT41 , alleged by the U. S.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.