Slides-Possible-supply-chain-attack-targeting-South-Asian-government-delivers-Shadowpad.pdf
Excerpt
Introduction
• In March 2023, we noticed a detection hit from September 2022 for mscoree.dll in an uncommon directory
− Mscoree.dll is a commonly used name for loaders of Shadowpad • This malicious DLL was embedded in a CAB file, itself embedded in an MSI installer
• The MSI metadata mentioned eOffice, as well as the name of a Pakistani governmental entity
4 | ©2023 Trend Micro Inc.
Introduction…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Virus Bulletin on virusbulletin.com.
Mentioned in the excerpt
More from Virus Bulletin10
- Google-Calendar-as-C2-infrastructure-a-China-nexus-campaign-with-stealthy-tactics.pdfVirus Bulletin · Added 24 Mar
- Down-the-GRAYRABBIT-hole-exposing-UNC3569-and-its-modus-operandi.pdfVirus Bulletin · Added 29 Jan
- DeceptiveDevelopment-and-North-Korean-IT-workers-from-primitive-crypto-theft-to-sophisticated-AI-based-deception.pdfVirus Bulletin · Added 16 Oct 2025
- Sugarcoating-KANDYKORN-a-sweet-dive-into-a-sophisticated-MacOS-backdoor.pdfVirus Bulletin · Added 15 Jan 2025
On the same topics
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Trust the Tunnel, Get the Trojan: Silver Fox Delivers Atlas RAT via Weaponized VPN Installershexastrike.com · Published 25 Mar
- Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent TrafficThe Hacker News · Published 19 Oct
- Investigating Ephemeral Supply Chain TamperingMandiant (Google) · Published 15 Oct
