China-Linked Ink Dragon Hacks Governments Using ShadowPad and FINALDRAFT Malware

According to Check Point Software, the threat actor known as Jewelbug has increasingly targeted governments in Europe since July 2025, while continuing to hit entities in Southeast Asia and South America, with the cluster being tracked as Ink Dragon. Check Point notes that Ink Dragon blends solid software engineering with disciplined operational playbooks and reuses platform-native tools to blend into normal enterprise telemetry, making intrusions both effective and stealthy.

The group is linked to the backdoor FINALDRAFT (aka Squidoor) and has used ShadowPad in its operations, including a ShadowPad IIS Listener module to turn compromised IIS servers into part of its C2 infrastructure. Ink Dragon has also weaponised ASP.NET machine key mismanagement to carry out ViewState deserialization attacks against IIS and SharePoint, installing the same time a modular framework that enables multi-stage deployment and stealthy lateral movement.

The campaign has been connected to a five-month intrusion against a Russian IT service provider, and a second actor known as REF3927 (aka RudePanda) has been observed on several of the same victim environments, though there are no indications of direct operational linkage. Ink Dragon’s arsenal also includes NANOREMOTE for data exfiltration via Google Drive API and tools such as ShadowPad Loader, CDBLoader, and 032Loader to decrypt and run payloads alongside FINALDRAFT for C2.

The analysis describes Ink Dragon’s relay-centric architecture as turning each foothold into a node in a wider, attacker-managed ecosystem, emphasising the need for defenders to identify and dismantle the entire relay chain rather than treating breaches in isolation.