VMware: 85 ShadowPad C2 servers in operation

VMware's Threat Analysis Unit says it has observed up to 85 command-and-control servers supported by ShadowPad malware variants since September 2021, according to The Hacker News. The VMware TAU said it had been studying three ShadowPad variants using TCP, UDP, and HTTP(S) protocols for communications between C2 servers and the team was able to detect the servers by using a tool called ZMap to generate a list of open hosts and scanning them. According to the group, it also found samples of Spyder and ReverseWindow malware, both malicious tools deployed by threat actors Winnti and LuoYu, communicating with ShadowPad C2 IP addresses. The team also reported observing overlaps between the Spyder sample and a Worker component of Winntis 4.0 trojan. Scanning APT malware C2s on the Internet is sometimes like finding a needle in a haystack. However, once the C2 scanning works, it can become a game changer as one of the most proactive threat detection approaches, according to Takahiro Haruyama, a senior threat researcher at VMware TAU.