In March 2020, as part of a study of information security threats, PT Expert Security Center specialists discovered a previously unknown backdoor and named it xDll, after the original name in the code. Due to a configuration error on the control server, some of the directories have become accessible from the outside.
, Shadowpad, xDll, Python-, .. Shadowpad Winnti .
Winnti ShadowPad,
ShadowPad Winnti (APT41, BARIUM, AXIOM), 2012 . . — . . Winnti , supply chain watering hole.
, , , , , , , , , ..
, - , , , , , .
ShadowPad 2017 . supply chain (, , CCleaner ASUS). Winnti ShadowPad ESET 2020 .
, xDll (. 2.2), - APT- . www.g00gle_jp.dynamic-dns[.]net, . , .
, , , . , , XOR 0x37. SkinnyD (Skinny Downloader) - . URL SkinnyD xDll .
SkinnyD, . xDll. . x.jpg ― xDll, XOR 0x37. , xDll SkinnyD.
cache.
, . MD5-- MAC- , xDll, . , , , , : 1990 . , .
ShadowPad, Python- .
, 50 . . , , .
:
,
,
— , ,
— : , .
CERT.
, ShadowPad supply chain , , , , .
Winnti, , 2019 . , Winnti. «» , . — SkinnyD, xDll, Python-.
, , , , , , , 459 Tonto team. Nettraveler.
Winnti , . , , , CCleaner ASUS.