Symantec Exposes Chinese APT Overlap: Zingdoor, ShadowPad, and KrustyLoader Used in Global Espionage

Symantec’s investigation reveals an intertwined web of Chinese espionage operations, with Zingdoor, ShadowPad, and KrustyLoader deployed across multiple victims and previously linked to Glowworm (also known as Earth Estries, FamousSparrow) and UNC5221. The researchers note that Zingdoor backdoors were used on the networks of three organisations, and KrustyLoader has been associated with UNC5221, a China-nexus group, according to Symantec.

The campaign saw two South American government agencies and a U.S. university compromised, with attackers abusing SQL Server and Apache HTTP vulnerabilities as alternate entry points and sideloading a DLL behind a legitimate BugSplat binary named mantec.exe to masquerade as Symantec software.

The toolkit was modular, with Zingdoor, ShadowPad, and KrustyLoader performing data collection, remote access, and second-stage payload delivery via Rust-based KrustyLoader; ShadowPad supports DLL sideloading and dynamic module downloads.

Notable details include KrustyLoader’s July 25, 2025 deployment, its first documentation in January 2024, and its association with the Sliver post-exploitation framework, as well as mass scanning for vulnerable SharePoint servers andCredential theft aimed at long-term, stealthy access.