The Living Mesh: Ink Dragon Turns European Government Servers into a Global ShadowPad Relay Network
Researchers at Check Point Research have uncovered a large-scale espionage operation conducted by the Chinese APT group Ink Dragon, which repurposes compromised government servers into a distributed command-and-traffic relay network—effectively turning the victims themselves into components of its command-and-control infrastructure.
Ink Dragon, also known as Earth Alux, Jewelbug, REF7707, and CL-STA-0049, has been active since at least early 2023. Initially focused on government, telecommunications, and public-sector organizations in Southeast Asia and South America, the group has in recent months significantly escalated its operations against government institutions in Europe. Its campaigns are marked by sophisticated engineering, disciplined operational tradecraft, and extensive abuse of legitimate system components, allowing the attacks to remain undetected for prolonged periods.
A defining characteristic of Ink Dragon is its strategy of embedding compromised servers into a global, distributed relay network rather than using them solely for espionage. To achieve this, the attackers deploy a specialized IIS module known as the ShadowPad Listener, which integrates directly into web servers and covertly intercepts HTTP(S) traffic. Each infected server becomes a node capable of receiving commands, forwarding them to other victims, and proxying connections—thereby expanding the adversary’s control infrastructure without relying on dedicated C2 servers.
Initial access is most commonly achieved through long-known yet still widespread misconfigurations in IIS and SharePoint. Ink Dragon actively exploits ASP.NET ViewState deserialization vulnerabilities by abusing predictable or leaked machineKey values, enabling arbitrary code execution. In several intrusions, the group also leveraged the ToolShell vulnerability chain in on-premises Microsoft SharePoint deployments, which allows unauthenticated remote code execution and web shell installation. During the summer of 2025, the group conducted large-scale scanning for vulnerable SharePoint servers, suggesting early access to exploit code.
Once a foothold is established, the attackers pivot rapidly into lateral movement. Service account credentials are harvested from IIS configurations and worker processes—credentials that are often reused across the organization. This enables Ink Dragon to escalate from web process execution to full server control and subsequently authenticate against adjacent hosts. Lateral movement relies heavily on RDP tunneling and built-in ShadowPad capabilities, with malicious activity carefully disguised as legitimate administrative sessions.
Persistence is achieved through scheduled tasks and the installation of SYSTEM-level services. Payloads are disguised as Windows system components such as conhost.exe and are often signed with valid digital certificates from well-known vendors, significantly reducing the likelihood of detection. For privilege escalation, Ink Dragon combines exploitation of local vulnerabilities—including techniques from the Potato family—with aggressive credential harvesting. Custom tooling is used to dump LSASS, extract NTLM hashes and Kerberos artifacts, and hunt for abandoned administrative RDP sessions from which domain admin tokens can be harvested.
The group pays particular attention to outbound connectivity. On compromised hosts, local firewall rules are created to allow unrestricted outbound traffic under the guise of legitimate Windows Defender components. This effectively transforms victim servers into open proxy nodes suitable for data exfiltration and command relay.
At the core of the entire operation lies the ShadowPad IIS Listener Module. It registers covert URL handlers via the HttpAddUrl API, selectively intercepts only “relevant” requests, and allows all other traffic to be processed normally by IIS. The module can classify connecting nodes as “servers” or “clients,” automatically link them together, and transparently relay data in both directions. As a result, a single compromised organization can quietly function as an intermediary control node for malware operations across entirely different networks, including those of other governments.
Beyond relay functionality, the same IIS module embeds a full ShadowPad command set for system management: information gathering, file and process control, interactive shell execution, and network proxying. Each node thus serves simultaneously as an access point and as part of a distributed C2 mesh. Analysis of debug strings within the module allowed researchers to reconstruct command relay chains and clearly illustrate how victim systems are interconnected.
Following persistence, Ink Dragon deploys additional post-exploitation components. These include multiple ShadowPad loaders using DLL sideloading, the bespoke CDBLoader—which abuses the cdb.exe debugger to execute shellcode in memory—and the LalsDumper tool, designed to stealthily dump LSASS via direct system calls. In later stages, the attackers deploy an updated version of the FinalDraft trojan, a modular RAT platform that leverages the Microsoft Graph API and Outlook mailboxes as its command channel.
FinalDraft supports fine-grained scheduling of communications, collection of RDP connection histories, weakening of Windows security controls, and high-speed data exfiltration through Microsoft cloud services. Its configuration is tightly bound to individual hosts, complicating both analysis and sample reuse.
Ink Dragon’s victims are predominantly government entities. In recent months, attacks against European organizations have increased markedly, with servers compromised in Europe subsequently used to support operations against targets in Africa and Southeast Asia. In several cases, activity from another Chinese group—RudePanda—was also observed on the same systems, involving separate IIS modules, web shells, and even the deployment of a kernel-level rootkit. However, researchers found no evidence of direct coordination between the two groups.
According to Check Point Research, Ink Dragon exemplifies a mature cyber-espionage model in which the distinction between “victim” and “command infrastructure” effectively disappears. Each newly compromised server strengthens the overall network, enhancing both its resilience and stealth. In such an environment, defending individual hosts is no longer sufficient: effective countermeasures must identify and dismantle the entire relay chain, or compromised systems will continue to serve the attackers indefinitely.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
