Proprietary 2017-07-18 · 17 days ·Backdoor, Remote Code Execution, Data Theft

NetSarang server tools shipped ShadowPad backdoor

Legitimate updates for NetSarang server tools, including Xmanager and Xshell, shipped with the ShadowPad backdoor. The payload gave attackers remote control and data theft capability inside sensitive organizations.

Story

In August 2017, Kaspersky traced suspicious DNS traffic inside a financial institution to NetSarang server-management software. The affected products were legitimate, signed NetSarang builds. The compromise lived inside software used by administrators, on machines with useful access.

The malicious code was embedded in nssock2.dll, a library loaded by the NetSarang tools. It was compiled on July 13, 2017 and signed with a legitimate NetSarang certificate. Public guidance later bounded distribution to NetSarang's website and in-application update utilities between July 18 and August 4, 2017.

ShadowPad stayed quiet until activated. The first layer sent host, domain, and user details every eight hours, then waited for a specially crafted DNS TXT record for a month-derived domain such as nylalobghyhirgh.com. A returned key decrypted the next stage. The packet marker decoded to DOOR.

Once active, the backdoor could upload files, create processes, download and execute attacker code, and keep an encrypted virtual file system in the registry. NetSarang removed the affected packages after notification and issued clean builds. The lesson was direct: a signed admin tool can become a patient access broker.

Affected Artifacts

Incident Context

Motive
Espionage
Attribution
Group
Cause
Build System Compromise
Transitive
No
Actor
Unknown Chinese-speaking actor
User Impact
10000

Indicators

External References

Source record: proprietary/netsarang/meta.yaml