APT41 likely compromised Taiwanese government-affiliated research institute with Shadow Pad and Cobalt Strike
Summary: Cisco Talos detected abnormal PowerShell commands in August 2023 in a Taiwanese government-affiliated research institute's environment, with the earliest infiltration trace dating to mid-July 2023, and assesses with medium confidence that APT41 carried out the campaign. The actor compromised three hosts, exfiltrated documents, and dropped ShadowPad and Cobalt Strike through a webshell, RDP access and a reverse shell, using a GoLang Cobalt Strike loader based on a Simplified Chinese anti-AV project and a ShadowPad loader targeting the 13-year-old imecmnt.exe binary.
Why it matters: Three compromised hosts and stolen documents at a research institute were enough for an actor the U.S. government links to Chinese nationals, and Talos could not determine the initial access vector - so the entry point into your environment may be equally invisible after the fact.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026