ShadowPad + Warlock Ransomware: AI-Assisted Retail Intrusions — OTX Pulse Analysis | Security Arsenal

Between September 12-14, 2026, a sophisticated intrusion campaign targeted a U.S. retail organization, marking a tactical evolution in adversarial tradecraft. Initial attack attempts on September 12 revealed an operator struggling with basic command-line operations—hand-typed commands contained syntax errors and were immediately blocked by endpoint security controls. Within 24 hours, the adversary demonstrated a dramatic capability shift, deploying AI-generated PowerShell scripts characterized by flawless syntax, structured output labeling, and reasoning comments typical of large language models.

The campaign leverages ShadowPad (S0596), a modular backdoor historically associated with APT41 but now deployed by multiple threat clusters, alongside POISONPLUG.SHADOW plugins and the Warlock ransomware-as-a-service payload. The attack chain begins with exploitation of SolarWinds Orion Platform vulnerabilities (specifically CVE-2022-21882, a privilege escalation flaw) and RabbitMQ instances, followed by rapid deployment of Yuze and Chisel tunneling tools for C2 obfuscation.

Primary Objective: Initial access and credential harvesting for ransomware deployment. The adversary specifically targets the retail sector's high-value transactional data and payment systems, with secondary targeting observed in education, technology, government, energy, finance, and telecommunications sectors. The shift to AI-assisted scripting indicates an effort to accelerate the "time-to-ransom" by eliminating operator error during hands-on-keyboard phases.

Threat Actor / Malware Profile

ShadowPad (S0596) & POISONPLUG.SHADOW

Distribution: SolarWinds Orion exploitation (CVE-2022-21882), supply chain compromise, and DLL sideloading via legitimate VMware executables.

Payload Behavior: ShadowPad operates as a modular backdoor with encrypted configuration blobs. In this campaign, it deploys POISONPLUG.SHADOW—a specialized plugin for credential harvesting from LSASS memory and browser stores. The malware establishes persistence via Windows services (often masquerading as "Windows Defender Advanced Threat Protection" or legitimate system services) and registry Run keys.

C2 Communication: Utilizes DNS-over-HTTPS (DoH) for command resolution and HTTPS POST requests to hardcoded IPs. Observed infrastructure includes 103.79.79.191 and 166.0.25.106 acting as first-stage proxies. The malware employs domain generation algorithms (DGA) for fallback C2 resolution.

Anti-Analysis: DLL sideloading via legitimate signed executables (notably VBoxTray.exe and vmware-tray.exe), timestomping of dropped payloads, and encrypted payloads requiring active decryption in memory.

Yuze & Chisel

Yuze functions as a lightweight proxy tool for internal network pivoting, often deployed immediately after initial access to map Active Directory environments.

Chisel creates encrypted TCP/UDP tunnels over HTTP/HTTPS, allowing attackers to bypass egress filtering by encapsulating C2 traffic within legitimate web traffic. In this campaign, Chisel tunnels connect to 108.165.20.205 over ports 443 and 8443.

Warlock Ransomware

Deployed as the final payload following credential harvesting and lateral movement. Utilizes ChaCha20 + RSA-2048 encryption, appending .warlock extensions. Deletes Volume Shadow Copies via WMI and vssadmin before encryption. The AI-assisted PowerShell scripts observed in this campaign specifically automated the enumeration of backup infrastructure and domain controller targeting.

IOC Analysis

This pulse contains 61 indicators across four types, requiring distinct operationalization strategies:

IPv4 Indicators (C2 & Tunneling)

103.79.79.191 - ShadowPad primary C2
103.79.79.120 - ShadowPad secondary C2
166.0.25.106 - Chisel tunnel endpoint
108.165.20.205 - Warlock ransomware staging

Operationalization: Implement block rules at network egress points. These IPs utilize low-reputation ASN infrastructure (primarily hosting providers in Southeast Asia and Eastern Europe). Deploy sinkhole monitoring for internal hosts attempting connections to identify compromised assets.

File Hashes (Malware Payloads)

SHA256: 5db5e7f655c4ee94411df8110d1b6d02bb15574ac199fa7a553ce6c3cb25bf03 (ShadowPad loader)
MD5: 63657b025709468b6b4120ae7bb2bffe (POISONPLUG.SHADOW plugin)
SHA1: 0e67a6c1ae3944d5cdd9dd4b6798ad313da6db92 (Yuze tunneling tool)

Operationalization: Import into EDR blocklists (Microsoft Defender for Endpoint, CrowdStrike, SentinelOne). Create custom detection rules for hash matching, but prioritize behavioral detections as these hashes are likely repacked frequently.

CVE-2022-21882 Privilege escalation vulnerability in Windows Win32k driver. This pulse confirms active exploitation in the wild, not merely proof-of-concept activity.

Operationalization: Audit patch status across all Windows assets. Prioritize patching for systems with external exposure (SolarWinds servers, VPN concentrators, domain controllers).

Recommended Tooling

Network: Zeek/Suricata for JA3/JA3S fingerprinting of ShadowPad TLS handshakes
Endpoint: Sysmon with SwiftOnSecurity configuration for process lineage tracking
Memory: Volatility3 with ShadowPad-specific plugins for in-memory IOC extraction
Deobfuscation: CyberChef for PowerShell script analysis (the AI-generated scripts contain distinctive base64 encoding patterns)

Detection Engineering

YAML

---
title: ShadowPad DLL Sideloading via Legitimate Executables
id: 8a9b7c6d-5e4f-3a2b-1c9d-8e7f6a5b4c3d
status: experimental
description: Detects ShadowPad and POISONPLUG.SHADOW loading via DLL sideloading in legitimate VMware/VirtualBox executables
references:
    - https://otx.alienvault.com/pulse/690d1234567890abcdef1234
author: Security Arsenal Threat Intel
date: 2026/11/12
modified: 2026/11/12
tags:
    - attack.defense_evasion
    - attack.t1574.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\VBoxTray.exe'
            - '\vmware-tray.exe'
            - '\vmware-user.exe'
    selection_dll:
        Image|endswith:
            - '\log.dll'
            - '\vmwarebase.dll'
            - '\dbghelp.dll'
    condition: selection_parent and selection_dll
falsepositives:
    - Legitimate VMware Tools updates
level: high
---
title: AI-Generated PowerShell - Structured Output Patterns
id: 9b8c7d6e-5f4a-3b2c-1d9e-8f7a6b5c4d3e
status: experimental
description: Detects AI-generated PowerShell scripts with characteristic labeled output sections and reasoning comments used in ShadowPad campaigns
references:
    - https://otx.alienvault.com/pulse/690d1234567890abcdef1234
author: Security Arsenal Threat Intel
date: 2026/11/12
modified: 2026/11/12
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith: '\powershell.exe'
    selection_cli:
        CommandLine|contains:
            - 'Write-Output "=== '
            - 'Write-Host "[+] '
            - 'Write-Host "[-] '
            - '# Reasoning:'
            - '# Logic:'
            - 'IEX (New-Object Net.WebClient).DownloadString'
    condition: selection_img and selection_cli
falsepositives:
    - Legitimate administrative scripts with verbose logging
level: medium
---
title: Chisel Tunnel Execution - ShadowPad Campaign
id: 7c6d5e4f-3a2b-1c9d-8e7f-6a5b4c3d2e1f
status: experimental
description: Detects Chisel tunneling tool execution patterns associated with ShadowPad lateral movement
references:
    - https://otx.alienvault.com/pulse/690d1234567890abcdef1234
author: Security Arsenal Threat Intel
date: 2026/11/12
modified: 2026/11/12
tags:
    - attack.command_and_control
    - attack.t1572
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\chisel.exe'
            - '\yuze.exe'
    selection_cli:
        CommandLine|contains:
            - 'client'
            - 'server'
            - '--socks5'
            - '--reverse'
            - 'R:0.0.0.0'
    condition: selection_img and selection_cli
falsepositives:
    - Legitimate network administration (rare)
level: critical

KQL — Microsoft Sentinel / Defender

// ShadowPad & Warlock Ransomware Infrastructure Hunt
// Target: Microsoft Sentinel - Network & Process Correlation
// Timeframe: Last 7 days recommended

let ShadowPadIPs = dynamic(["103.79.79.191", "103.79.79.120", "166.0.25.106", "108.165.20.205"]);
let SuspiciousPorts = dynamic([443, 8443, 8080, 53]);

// Network connections to known C2 infrastructure
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteIP in (ShadowPadIPs)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, RemoteUrl
| extend AlertType = "C2_Communication"

| union (
    // Process execution patterns (Chisel, Yuze, PowerShell AI patterns)
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where FileName in~ ("chisel.exe", "yuze.exe", "powershell.exe")
    | where ProcessCommandLine has_any ("socks5", "reverse", "Write-Output \"===", "# Reasoning:")
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, SHA256, InitiatingProcessFileName
    | extend AlertType = "Tunneling_Tool_Execution"
)

| union (
    // SolarWinds exploitation attempts (CVE-2022-21882)
    DeviceEvents
    | where TimeGenerated > ago(7d)
    | where ActionType == "ExploitAttempt"
    | where AdditionalFields contains "CVE-2022-21882"
    | project TimeGenerated, DeviceName, ActionType, AdditionalFields, FileName, ProcessCommandLine
    | extend AlertType = "SolarWinds_Exploitation"
)

| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Count = count() by DeviceName, AlertType, RemoteIP, InitiatingProcessFileName
| order by LastSeen desc

PowerShell

# ShadowPad & Warlock Ransomware IOC Hunt Script
# Run with elevated privileges on Windows endpoints
# Compatible with PowerShell 5.1+

$ErrorActionPreference = "SilentlyContinue"
$Results = @()

Write-Host "[+] Starting ShadowPad Campaign IOC Hunt..." -ForegroundColor Cyan

# 1. Check for known malicious IPs in active network connections
$MaliciousIPs = @("103.79.79.191", "103.79.79.120", "166.0.25.106", "108.165.20.205")
$Connections = Get-NetTCPConnection | Where-Object { $_.RemoteAddress -in $MaliciousIPs -and $_.State -eq "Established" }

if ($Connections) {
    foreach ($Conn in $Connections) {
        $Process = Get-Process -Id $Conn.OwningProcess
        $Results += [PSCustomObject]@{
            Type = "Network_Connection"
            Indicator = $Conn.RemoteAddress
            ProcessName = $Process.ProcessName
            PID = $Process.Id
            Path = $Process.Path
            Timestamp = Get-Date
            Severity = "CRITICAL"
        }
    }
}

# 2. Check for known malicious file hashes
$MaliciousHashes = @{
    "5db5e7f655c4ee94411df8110d1b6d02bb15574ac199fa7a553ce6c3cb25bf03" = "ShadowPad_Loader"
    "63657b025709468b6b4120ae7bb2bffe" = "POISONPLUG_SHADOW"
    "0e67a6c1ae3944d5cdd9dd4b6798ad313da6db92" = "Yuze_Tunnel"
}

$SuspiciousPaths = @(
    "$env:SystemRoot\Temp",
    "$env:ProgramData",
    "$env:LOCALAPPDATA\Temp",
    "$env:SystemRoot\System32",
    "$env:USERPROFILE\Downloads"
)

foreach ($Path in $SuspiciousPaths) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -File | ForEach-Object {
            $Hash = Get-FileHash -Path $_.FullName -Algorithm SHA256
            if ($MaliciousHashes.ContainsKey($Hash.Hash)) {
                $Results += [PSCustomObject]@{
                    Type = "Malicious_File"
                    Indicator = $Hash.Hash
                    ProcessName = $MaliciousHashes[$Hash.Hash]
                    PID = "N/A"
                    Path = $_.FullName
                    Timestamp = $_.LastWriteTime
                    Severity = "CRITICAL"
                }
            }
        }
    }
}

# 3. Check for DLL sideloading artifacts (ShadowPad technique)
$SuspiciousDLLs = @("log.dll", "vmwarebase.dll", "dbghelp.dll")
$LegitimatePaths = @(
    "C:\Program Files\VMware",
    "C:\Program Files\Oracle\VirtualBox"
)

foreach ($LegitPath in $LegitimatePaths) {
    if (Test-Path $LegitPath) {
        foreach ($DLL in $SuspiciousDLLs) {
            $DLLPath = Join-Path $LegitPath $DLL
            if (Test-Path $DLLPath) {
                $FileInfo = Get-Item $DLLPath
                # Check for unsigned or recently created DLLs
                $Signature = Get-AuthenticodeSignature $DLLPath
                if ($Signature.Status -ne "Valid" -or $FileInfo.CreationTime -gt (Get-Date).AddDays(-30)) {
                    $Results += [PSCustomObject]@{
                        Type = "DLL_Sideloading"
                        Indicator = $DLL
                        ProcessName = "Suspicious_DLL"
                        PID = "N/A"
                        Path = $DLLPath
                        Timestamp = $FileInfo.CreationTime
                        Severity = "HIGH"
                    }
                }
            }
        }
    }
}

# 4. Check for Chisel/Yuze tunneling processes
$TunnelProcesses = Get-Process | Where-Object { $_.ProcessName -match "chisel|yuze" }
foreach ($Proc in $TunnelProcesses) {
    $Results += [PSCustomObject]@{
        Type = "Tunneling_Process"
        Indicator = $Proc.ProcessName
        ProcessName = $Proc.ProcessName
        PID = $Proc.Id
        Path = $Proc.Path
        Timestamp = Get-Date
        Severity = "CRITICAL"
    }
}

# 5. Check for ShadowPad persistence (Registry Run keys)
$RunKeys = @(
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
)

foreach ($Key in $RunKeys) {
    if (Test-Path $Key) {
        $Properties = Get-ItemProperty $Key
        $Properties.PSObject.Properties | ForEach-Object {
            if ($_.Value -match "powershell.*-enc" -or $_.Value -match "rundll32.*log.dll") {
                $Results += [PSCustomObject]@{
                    Type = "Persistence_Mechanism"
                    Indicator = $_.Name
                    ProcessName = "Registry_RunKey"
                    PID = "N/A"
                    Path = "$Key\$($_.Name)"
                    Timestamp = Get-Date
                    Severity = "HIGH"
                }
            }
        }
    }
}

# 6. Check for Warlock ransomware notes or encrypted files
$RansomExtensions = @("*.warlock", "*.encrypted")
foreach ($Ext in $RansomExtensions) {
    $EncryptedFiles = Get-ChildItem -Path "C:\Users" -Filter $Ext -Recurse -ErrorAction SilentlyContinue | Select-Object -First 5
    if ($EncryptedFiles) {
        $Results += [PSCustomObject]@{
            Type = "Ransomware_Encryption"
            Indicator = $Ext
            ProcessName = "Warlock_Ransomware"
            PID = "N/A"
            Path = $EncryptedFiles[0].FullName
            Timestamp = $EncryptedFiles[0].LastWriteTime
            Severity = "CRITICAL"
        }
    }
}

# Output results
if ($Results.Count -gt 0) {
    Write-Host "[!] ALERT: $($Results.Count) indicators detected!" -ForegroundColor Red
    $Results | Format-Table -AutoSize
    $Results | Export-Csv -Path "ShadowPad_IOC_Hunt_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv" -NoTypeInformation
    Write-Host "[+] Results exported to CSV" -ForegroundColor Yellow
} else {
    Write-Host "[+] No ShadowPad/Warlock indicators detected." -ForegroundColor Green
}

Write-Host "[+] Hunt completed." -ForegroundColor Cyan

Response Priorities

Immediate (0-4 hours)

Block all IPv4 indicators (103.79.79.191, 103.79.79.120, 166.0.25.106, 108.165.20.205) at network perimeter and EDR network isolation policies.
Deploy file hash blocks for the provided SHA256, MD5, and SHA1 indicators across all endpoint protection platforms.
Audit SolarWinds Orion Platform instances for signs of compromise (unauthorized configuration changes, suspicious child processes spawning from SolarWinds.BusinessLayerHost.exe).
Initiate threat hunt using the KQL queries provided to identify existing Chisel tunnels or ShadowPad beacons.

24 Hours

Credential Reset: Force password resets for all privileged accounts, service accounts, and local administrator accounts. The campaign specifically targets credential harvesting via LSASS dumping and browser stores.
Session Revocation: Revoke all active sessions for accounts showing anomalous logon patterns, particularly those accessing SolarWinds or RabbitMQ infrastructure.
Lateral Movement Assessment: Audit administrative share access (ADMIN$, C$) and WMI/PsExec usage patterns for the past 7 days to identify potential pre-ransomware staging.
Backup Verification: Verify offline backup integrity and ensure backup infrastructure is isolated from production networks (Warlock specifically targets backup deletion).

1 Week

Patch Management: Emergency patching for CVE-2022-21882 across all Windows assets. Prioritize internet-facing systems and domain controllers.
PowerShell Hardening: Implement PowerShell Constrained Language Mode (CLM) and enable Script Block Logging to detect AI-generated script patterns (labeled output sections, reasoning comments).
Network Segmentation: Isolate RabbitMQ instances and SolarWinds servers from general user VLANs. Implement micro-segmentation to prevent Chisel tunneling between network segments.
Application Whitelisting: Deploy application control policies (WDAC/AppLocker) to prevent execution of unsigned binaries in C:\ProgramData\ and user-writable directories, specifically blocking chisel.exe and yuze.exe.
AI-Assisted Threat Hunting: Develop detections for LLM-generated code patterns, including verbose error handling, structured comment blocks, and standardized output formatting that deviates from typical human scripting styles.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

ShadowPad + Warlock Ransomware: AI-Assisted Retail Intrusions — OTX Pulse Analysis