Top Tweets for #shadowpad
#ThreatProtection A China-aligned cluster is deploying #ShadowPad via signed binaries and DLL sideloading to infiltrate Asian government networks, read more: https://t.co/tLZNEljUaj
Pakistan
Thailand
Malaysia
India
Myanmar
Sri Lanka
Taiwan
#ShadowPad
Inside Shadow-Earth-053: A China-Aligned Cyberespionage Campaign Against Government and Defense Sectors in Asia
https://t.co/RQZT2kiMDc
Chinese state-sponsored cyber operations use industrialized networks of compromised SOHO routers, IoT devices, and edge appliances for stealthy reconnaissance, C2, and data exfiltration via local exit nodes. #China #CovertNetworks #ShadowPad
https://t.co/b3ii4RIugD
The #Shadowpad samples are signed with two certificates both issued from the signer “四川奇雨网络科技有限公司”. This is a company located in Sichuan Chengdu, China specialised in developing computer software and providing network communication devices.
🔥 NEW research published: We uncover #DKnife, a China-nexus gateway-monitoring framework that intercepts network traffic, monitors user activity, and delivers malware #Shadowpad & #DarkNimbus via routers and edge devices.
https://t.co/Qw2gAEtFXZ
China-linked #InkDragon expands into Europe, building a distributed relay network by weaponizing compromised servers with a custom #ShadowPad IIS listener alongside new TTPs and an evolved FinalDraft.https://t.co/HiVSN2rngc
Shai-Hulud’s second wave steals npm credentials from 25,000+ repos, ShadowPad exploits WSUS flaws, Grafana SCIM allows privilege escalation (CVE-2025-41115). Harvard, Mazda breached; Moscow postal outage impacts Ukraine. #ShadowPad #WindowsRisks
https://t.co/xzMfGRo3z4
Attackers deliver #ShadowPad via newly patched #WSUS RCE bug
https://t.co/wEdyfLyasU
#securityaffairs #hacking #malware
#ThreatProtection #ShadowPad and #PurpleHaze #malware found in China-backed campaigns, read more: https://t.co/NhsNy3Hsm3
IntinelOne revealed it was targeted in a China-backed cyber-espionage campaign with 70+ orgs. APT15 & UNC5174 used ShadowPad & PurpleHaze to hit vendors, govs, & media. Security vendors are now in the crosshairs.
#CyberSecurity #APT #ThreatIntel #ShadowPad #InfoSec
#PurpleHaze and #ShadowPad threats hit multiple sectors from July 2024 to March 2025. Victims include a South Asian government entity and European media organization. Some attacks are linked to known groups #APT15 and #UNC5174. #onpatrol4malware
https://t.co/41wKMWCAW5
⚠️Chinese hackers hit governments, media, and cybersecurity firms in a global cyber espionage spree. Over 70 orgs targeted using tools like ShadowPad and PurpleHaze.
Read: https://t.co/hDJ1vu5jS2
#CyberSecurity #China #CyberAttack #PurpleHaze #ShadowPad #APT15
中国系APT「PurpleHaze」がSentinelOne等含む70超の戦略組織にShadowPad感染。戦時に備えた「flip‑the‑switch」型展開を意図。APT15/UNC5174関連が示唆。セキュリティ業界にも標的リスク顕在化。#中国 #サイバースパイ #ShadowPad https://t.co/ioWop68DHY
64[.]71[.]158[.]237
212[.]24[.]108[.]132
162[.]0[.]217[.]176
46[.]101[.]196[.]188
103[.]215[.]165[.]104
54[.]65[.]160[.]56
69[.]94[.]128[.]214
62[.]116[.]178[.]4
38[.]6[.]222[.]170
172[.]104[.]160[.]78
#ShadowPad
In our previous research, we identified a new #ShadowPad infrastructure cluster using a spoofed Dell certificate and modified HTTP headers.
https://t.co/8ICMHiYniC
This subtle change, including a fake "Dell Data Vault" certificate, helps evade detection.
The findings underscore the importance of scrutinizing non-standard certificates in threat hunting.
#CyberSecurity #MalwareAnalysis #ThreatHunting #SecurityResearch
#Fofa Query for #NomadPanda / #RedFoxtrot #APT 's campaign using #ShadowPad Cluster.
#Query: https://t.co/uA0c9mQGoo="Microsoft Windows Publisher"
Link: https://t.co/q4khuTWtQT
Infra (as on 5th Apr): https://t.co/gC8gAe0LE5
@500mk500 (for update pls) #Backdoor #Malware #ioc
📌 ShadowPad Sample Detected
Identified upon initial upload via our detection rules.
Rule details: https://t.co/aGTZLkJb5p
#ShadowPad
#FlaxTyphoon #APT Targeting Asian countries with #ShadowPad
File: Packagec.ps1 (Payload Downloader)
68efe445523263e233925f8d3f9953f7
GET C2: http://149.28.137.179/a/Dvx.zip
File: Dvx[.]zip
43c02ac3fc7a71bb7a841ec19f53ece7
C2: TCP 45.77.33[.]174:443 / update.updatemic[.]com
[2/2]
File: msimg32.dll (Malicious DLL)
47ff4376e5b93de9ad7819c05d5dad70
File: h.exe (Legitimate Executable)
39624b7dd47f63720654a64cd9f9a988
File: AK.bat (Purpose Not Known as of now)
3320400d5359af97916b6dda9d13d344
@500mk500 #FlaxTyphoon #APT #ShadowPad #Malware #ioc
#FlaxTyphoon #APT Targeting Asian countries with #ShadowPad
File: Packagec.ps1 (Payload Downloader)
68efe445523263e233925f8d3f9953f7
GET C2: http://149.28.137.179/a/Dvx.zip
File: Dvx[.]zip
43c02ac3fc7a71bb7a841ec19f53ece7
C2: TCP 45.77.33[.]174:443 / update.updatemic[.]com
This campaign is also the first documented time that FamousSparrow used #ShadowPad, a privately sold modular backdoor known to only be supplied to threat actors affiliated with 🇨🇳. 4/5
Last Seen Hashtags on Sotwe
orb8
Seen from United States
فحل_الرياض
Seen from Saudi Arabia
hotwife
Seen from France
zonguldakpasif
Seen from Turkey
gay #nsfw #gaping
Seen from United Kingdom
minichat since:2026-09-19 filter:videos
Seen from Austria
gayara
Seen from Turkey
FlashMob1D2015
Seen from United States
snapchat
Seen from Italy
ipcam brosis(***)(***)(***)(***)(***)(***)(***)(***) +filter:videos
Seen from Singapore
Most Popular Users
Elon Musk 
@elonmusk
241.7M followers
Barack Obama
@barackobama
119M followers
Cristiano Ronaldo
@cristiano
114.5M followers
Donald J. Trump
@realdonaldtrump
111.9M followers
Narendra Modi
@narendramodi
107.2M followers
Rihanna
@rihanna
98.7M followers
NASA
@nasa
92.4M followers
Justin Bieber
@justinbieber
91.8M followers
KATY PERRY
@katyperry
90M followers
Taylor Swift
@taylorswift13
84M followers
Lady Gaga
@ladygaga
75.5M followers
Virat Kohli
@imvkohli
73.5M followers
Kim Kardashian
@kimkardashian
70.9M followers
YouTube
@youtube
68.8M followers
Neymar Jr
@neymarjr
66.5M followers
Bill Gates
@billgates
65.2M followers
Selena Gomez
@selenagomez
63.1M followers
The Ellen Show
@theellenshow
62.3M followers
CNN
@cnn
61.8M followers
X
@x
60.7M followers