APT41 Hackers Use ShadowPad, Cobalt Strike in Taiwanese Institute Cyber Attack | Cybersecurity

Aug 02, 2024. Ravie Lakshmanan Cyber Espionage / Malware.

A Taiwanese government-affiliated research institute that specializes in computing and associated technologies was breached by nation-state threat actors with ties to China, according to new findings from Cisco Talos.

The unnamed organization was targeted as early as mid-July 2023 to deliver a variety of backdoors and post-compromise tools like ShadowPad and Cobalt Strike. It has been attributed with medium confidence to a prolific hacking group tracked as APT41.

“The ShadowPad malware used in the current campaign exploited an outdated vulnerable version of Microsoft Office IME binary as a loader to load the customized second-stage loader for launching the payload,” security researchers Joey Chen, Ashley Shen, and Vitor Ventura said.

“The threat actor compromised three hosts in the targeted environment and was able to…