{"id":34659,"date":"2022-06-27T20:48:10","date_gmt":"2022-06-27T17:48:10","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=34659"},"modified":"2026-03-28T01:10:25","modified_gmt":"2026-03-27T22:10:25","slug":"an-apt-group-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-industrial-and-telecommunications-companies-in-pakistan","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/an-apt-group-uses-shadowpad-backdoor-and-ms-exchange-vulnerability-to-attack-industrial-and-telecommunications-companies-in-pakistan\/","title":{"rendered":"An APT group uses ShadowPad backdoor and\u00a0MS Exchange vulnerability\u00a0to attack industrial and telecommunications companies in Pakistan"},"content":{"rendered":"\n

In mid-October 2021, Kaspersky ICS CERT discovered a previously unknown Chinese-speaking threat actor attacking telecommunications, manufacturing, and transport organizations in several Asian countries. During the initial attacks, the group exploited MS Exchange vulnerability to deploy ShadowPad malware and infiltrated building automation systems of one of the victims. <\/strong><\/p>\n\n\n\n

A building automation system (BAS) connects all the functions inside the building \u2013 from electricity and heating to fire and security \u2013 and is managed from one control center. Once a BAS is compromised, all processes within that organization are at risk, including those relating to information security.<\/p>\n\n\n\n

The experts at Kaspersky ICS CERT witnessed attacks on organizations in Pakistan, Afghanistan, and Malaysia in industrial and telecommunications sector. The attacks had a unique set of tactics, techniques, and procedures (TTPs), which led the experts to believe that the same Chinese-speaking threat actor was behind all of these observed attacks. Their attention was particularly drawn to the actor\u2019s use of engineering computers in building automation systems, belonging to the companies\u2019 infrastructures, as the point of infiltration\u2013 that is unusual for APT groups. By taking control over those systems, the attacker can reach other, even more sensitive systems of the attacked organization.<\/p>\n\n\n\n

As the investigation showed, the main tool of the APT group is\u00a0ShadowPad<\/a>\u00a0backdoor. Kaspersky has been witnessing this malware being used by various Chinese-speaking APT actors. During the attacks of the observed actor, the ShadowPad backdoor was downloaded onto the attacked computers under the guise of legitimate software. In many cases the attacking group exploited a known vulnerability in MS Exchange, and entered the commands manually, that indicates the highly targeted nature of their campaigns.<\/p>\n\n\n\n

\u201cThe building automation systems are rare targets for advanced threat actors. However, those systems can be a valuable source of highly confidential information and may provide the attackers with a backdoor to other, more secured, areas of infrastructures. Since these attacks develop extremely rapidly, they must be detected and mitigated during their very early stages. Thus, our advice is to constantly monitor the mentioned systems, especially in critical sectors,\u201d<\/em> comments Kirill Kruglov, security expert at Kaspersky ICS CERT.  <\/p>\n\n\n\n

Learn more about the attacks through building automation systems\u00a0on Kaspersky\u2019s ICS CERT website.<\/a><\/p>\n\n\n\n

To keep your OT computers protected from various threats, Kaspersky experts recommend: <\/strong><\/p>\n\n\n\n