ShadowPad Malware Deployed Against Pakistani Targets
An unidentified threat actor has compromised a widely used application in Pakistan, resulting in the distribution of ShadowPad, a successor to the PlugX backdoor associated with Chinese hacking groups.
The targets affected by this cyber attack include a government entity, a public sector bank, and a telecommunications provider in Pakistan. According to Trend Micro, the infections occurred between February and September of 2022.
Trend Micro suggests that this incident may be a result of a supply-chain attack, where a legitimate software application used by the targeted entities is tampered with to deploy malware capable of gathering sensitive information from compromised systems.
The attack involved a malicious installer for E-Office, a software developed by the National Information Technology Board (NITB) of Pakistan to facilitate paperless operations in government departments.
Attack Vector Still Unknown
The exact method used to deliver the compromised E-Office installer to the victims is currently unknown. However, there is no evidence thus far to suggest that the build environment of the Pakistani government agency involved has been compromised.
This raises the possibility that the threat actor obtained the legitimate installer and modified it to include malware. They likely enticed victims to run the trojanized version through social engineering tactics.
As part of the attack, three files were added to the genuine MSI installer: Telerik.Windows.Data.Validation.dll, mscoree.dll, and mscoree.dll.dat. Among these, Telerik.Windows.Data.Validation.dll is a valid applaunch.exe file signed by Microsoft, susceptible to DLL side-loading. This allows the loading of mscoree.dll, which in turn loads mscoree.dll.dat, the payload carrying the ShadowPad malware.
Trend Micro notes that the obfuscation techniques used to conceal the DLL and the final-stage malware decryption are an evolution of methods previously exposed by Positive Technologies in January 2021, linked to the Winnti group (also known as APT41), engaged in Chinese cyber espionage campaigns.
