SentinelOne Sees No Breach After Hardware Supplier Hacked

Cybersecurity firm SentinelOne said suspected Chinese attackers infiltrated a logistics firm that it used to supply hardware to its employees. The intrusion doesn’t appear to have resulted in an infiltration of its own, corporate network, the company said.

See Also: Tracking and Mitigating Emerging Threats in Third-Party Risk Management

Researchers at SentinelOne said Monday it appeared to have been targeted at least twice by the group, beginning with an October reconnaissance operation tied to activity the company tracks as PurpleHaze. That was followed early this year by a breach of the IT services and logistics company that provided hardware logistics for SentinelOne’s employees.

SentinelOne said it alerted the firm to the hack attack, and “a thorough investigation into SentinelOne’s infrastructure, software and hardware assets found no evidence of compromise.”

The same hackers may have used similar techniques against “a South Asian government entity that provides IT solutions and infrastructure across multiple sectors” in June 2024 and again in October 2024. Other victims include a large European media organization in September 2024, as well as intrusions at more than 70 other organizations from July 2024 through March.

Researchers said all of the attacks involved ShadowPad malware, a backdoor provided exclusively to Chinese attack groups, according to multiple researchers.

“At this point, it remains unclear whether the perpetrators’ focus was solely on the targeted IT logistics organization or if they intended to extend their reach to downstream organizations as well,” SentinelOne said. “This case underscores the persistent threat posed by suspected Chinese threat actors, who have a history of seeking to establish strategic footholds to potentially compromise downstream entities.”

Other cybersecurity firms have also detailed a rise in attacks involving ShadowPad.

DarkTrace said in March that it tracked a surge in attacks involving ShadowPad from April to November 2024. These attacks typically involved attackers attempting to abuse Check Point VPN credentials to gain access to victims’ networks, after which they infected systems with ShadowPad through a domain controller. In at least one of those cases, the attackers exfiltrated extensive amounts of data.

Trend Micro in February detailed two cases from November 2024 that involved ShadowPad infecting organizations in Europe. Based on the tools, tactics and techniques used in the attacks, researchers identified 21 companies that were targeted by the same group last year, predominantly in Europe and Asia, and to a lesser extent the Middle East and South America. Half of the targets hailed from the manufacturing industry. In two of those attacks, the threat actor also deployed a previously unseen type of ransomware. Why it chose to do so, and only for those two targets, isn’t clear.

“This is an uncommon move for threat actors using ShadowPad,” Trend Micro said, although in 2019 Google’s Mandiant incident response group reported seeing APT41 in some cases attempting to deploy ransomware.

Eset also reported seeing a surge in attacks involving ShadowPad beginning in July 2024, after a relative period of dormancy that appears to have begun in 2022.

Even so, last August, Cisco Talos reported discovering an APT41 campaign “that compromised a Taiwanese government-affiliated research institute that started as early as July 2023, delivering the ShadowPad malware, Cobalt Strike and other customized tools for post-compromise activities.”

Used in Espionage, Financial Attacks

Eset has described ShadowPad as being “a privately sold backdoor, known to only be supplied to China-aligned threat actors,” including for cyberespionage purposes.

Multiple cybersecurity firms have said that the prolific hacking group tracked as APT41 – aka Barium, Brass Typhoon and Wicked Panda and Wicked Spider – often uses ShadowPad both for cyberespionage as well as attacks that appear to be financially motivated and possibly tied to the hackers moonlighting in pursuit of personal profit.

Trend Micro said the malware appears to have been developed by APT41 and put into use by 2017 – although some researchers said it appears to have been in use since 2015 – before being shared exclusively with other Chinese hacking groups starting in 2019.

The modular malware’s capabilities include serving as a remote access Trojan, or RAT, to give attackers persistent access to a victim’s network. Other plug-ins facilitate “keylogging, screenshot grabbing and file retrieval,” Trend Micro said. “The code is obfuscated by a custom algorithm and only decoded in memory.”

Based on the leak of information from private Chinese hacking firm iSoon, Recorded Future reported last year that iSoon “very likely uses and sells access to custom malware families such as ShadowPad and Winnti,” the latter of which is a backdoor (see: iSoon Leak Shows Links to Chinese APT Groups).

Google Threat Intelligence Group in January detailed how attackers who use ShadowPad – which it tracks as PoisonPlug.Shadow – have been employing “a custom obfuscating compiler” it calls ScatterBrain. This appears to be an updated version of an obfuscating compiler called ScatterBee, which was previously used to obfuscate ShadowPad binaries.

In 2022, Secureworks reported seeing ShadowPad infections that traced to attack activity affiliated both with the Chinese Ministry of State Security civilian intelligence agency as well as the People’s Liberation Army threat groups.

Eset said ShadowPad-using group it tracks appears to be distinct from the Chinese APT group Salt Typhoon – so-called by Microsoft – that has been tied to numerous attacks, including major intrusions of U.S. telecommunications firms. Microsoft has linked the two groups, finding overlap that it said may be evidence of the “digital quartermaster” theory of Chinese hacking, which posits that a Beijing-backed organization shared hacking tools and infrastructure among a network of threat actors, many of them private sector contractors such as iSoon.