ShadowPad

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Malware family tracked by Malpedia. ID: win.shadowpad

Threat Analysis

ShadowPad is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://attack.mitre.org/groups/G0096

→https://blog-en.itochuci.co.jp/entry/2024/05/23/090000

→https://blog.talosintelligence.com/chinese-hacking-group-apt41-compromised-taiwanese-government-affiliated-research-institute-with-shadowpad-and-cobaltstrike-2/

→https://blogs.vmware.com/security/2022/10/threat-analysis-active-c2-discovery-using-protocol-emulation-part3-shadowpad.html

→https://cdn.securelist.com/files/2017/08/ShadowPad_technical_description_PDF.pdf

Quick Facts

TypeAPT / Threat Group

Aliases4

Also Known As

XShellGhostPOISONPLUG.SHADOWShadowPadwin.shadowpad

External Intelligence

Malpedia: win.shadowpad

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search ShadowPad