ShadowSilk Targets Penetration-Testing Tools and Public Exploits to Breach Organizations

Cybersecurity researchers have traced ShadowSilk, an advanced persistent threat (APT) cluster, to activity since at least 2023, with operations continuing into July 2025 and targeting primarily government entities across Central Asia and the Asia-Pacific region. According to Group-IB, ShadowSilk breaches rely on a mix of publicly available exploits, penetration-testing tools, and custom malware, using initial access via phishing emails that deliver password-protected archives containing executables.

The group’s toolset includes open-source reconnaissance and scanning utilities such as sqlmap, wpscan, fscan, gobuster, and dirsearch, and their campaigns exploit CVEs including CVE-2018-7600 (Drupalgeddon2), CVE-2018-7602, and CVE-2024-27956, with staging and exfiltration conducted through Telegram-based C2 and other scripts.

Group-IB notes a bilingual operation with Chinese-speaking and Russian-speaking sub-groups coordinating across shared victim networks, and evidence of persistence through registry keys and data exfiltration via obfuscated PowerShell, culminating in the optional use of web panels like JRAT and Morf Project to manage compromised devices. By mid-2025, over 35 victims—primarily in government sectors—had been identified, with infrastructure refreshes following exposures such as the January 2025 disclosure.