Inside Ink Dragon: Revealing the Relay Network and Inner Workings of a Stealthy Offensive Operation

according to Check Point Research, Ink Dragon is a Chinese-aligned espionage cluster that has expanded from Southeast Asia and South America into Europe, targeting government and public-sector infrastructure. The operation centres on a ShadowPad IIS Listener Module that turns compromised servers into active relay nodes, enabling a distributed C2 network that relays commands between servers and clients with minimal direct contact with the operator.

The attackers use a multi-component toolkit, including ShadowPad loaders, LalsDumper for LSASS dumping, and a new FinalDraft variant that uses Microsoft Graph API and Outlook mail flows for command and control. Initial access commonly relies on ViewState deserialization or ToolShell exploits against SharePoint, with later stages preserving access via scheduled tasks, services, and RDP tunnelling to broaden footholds.

Ink Dragon’s relay-centric model also enables victims to function as hop points, obscuring origin and direction of traffic while expanding reach across multiple victim networks. The report, dated 16 December 2025, details the evolution of their techniques and the maturity of their multi-victim infrastructure.