Turning Servers Against Themselves Inside a ShadowPad-Driven Campaign

A sophisticated Chinese state‑aligned group, tracked as Ink Dragon (also known as Earth Alux, Jewelbug, REF7707, CL‑STA‑0049), is running a ShadowPad‑driven campaign that turns compromised servers into relay nodes for its global C2 infrastructure, Check Point Research has revealed.

The attackers exploit long‑known IIS/SharePoint flaws to gain initial access, then deploy a custom ShadowPad IIS Listener module that lets each victim forward commands and traffic, effectively turning breached organizations into part of the attackers’ own mesh network.​

How the Relay Network Works

Ink Dragon’s core innovation is the ShadowPad IIS Listener Module, a malicious component loaded into IIS that registers hidden HTTPS endpoints via the Windows HttpAddUrl API, allowing it to intercept specific HTTP(S) requests while allowing regular traffic to pass through.

When a request matches a configured wildcard URL pattern, the module decrypts the payload and checks whether it adheres to the attackers’ proprietary protocol; if not, it falls back to legitimate IIS behavior, serving static files or error pages.​

This module can operate in two modes: as a full ShadowPad backdoor on the local server, and as a relay node in a distributed mesh.

It maintains two peer lists “servers” and “clients” and automatically pairs them so that one victim forwards traffic between an upstream operator and a downstream implant, acting as a transparent hop.

Once paired, the compromised host streams bidirectional data between the two peers, enabling command delivery to implants with no direct internet access.​

Technical Execution and TTPs

Initial access is typically achieved via ASP.NET ViewState deserialization, exploiting predictable or publicly known machineKey values on IIS/SharePoint servers to achieve RCE, or by abusing the ToolShell SharePoint exploit chain (CVE‑2025‑49706 / CVE‑2025‑53771 and related) for unauthenticated RCE and web shell deployment.

From there, attackers harvest IIS worker/app‑pool credentials, escalate to SYSTEM (often using local exploits like PrintNotifyPotato), and establish persistent access via scheduled tasks (e.g., named “SYSCHECK”) or disguised services (e.g., “WindowsTempUpdate”).​

ShadowPad is deployed using a triad loader pattern: a legitimate‑looking executable (often masquerading as a Windows binary) side‑loads a malicious DLL, which decrypts and runs the ShadowPad core in memory from an encrypted .tmp file, then deletes the payload to reduce forensic traces.

The same IIS Listener module that builds the relay mesh also provides a rich backdoor interface, supporting reconnaissance, file operations, process/service control, and internal proxying to pivot deeper into the network.​

FinalDraft, a modular RAT used in later stages, communicates via the Microsoft Graph API (Outlook mail) using OAuth refresh tokens, hiding commands and exfiltrated data within encrypted email drafts with subjects such as rsessionid/psessionid.

This cloud‑proxied C2, combined with the ShadowPad relay fabric, allows Ink Dragon to route traffic across unrelated victim networks, obscuring the true origin and making detection and disruption significantly harder.​

Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates