Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-06 00:58:39 UTC
Home > List all groups > List all tools > List all groups using tool ShadowPad Winnti
 Tool: ShadowPad Winnti
Names
ShadowPad Winnti
POISONPLUG.SHADOW
XShellGhost
Category Malware
Type Backdoor
Description
(Kaspersky) ShadowPad: How Attackers hide Backdoor in Software used by Hundreds of Large
Companies around the World.
Information
Malpedia Last change to this tool card: 22 February 2025
Download this tool card in JSON format
All groups using tool ShadowPad Winnti
Changed Name Country Observed
APT groups
 APT 41 2012-Jul 2025
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=0eedd5c2-57d7-447c-954d-e0e2ade187dc
Page 1 of 2

Bronze Butler, Tick, RedBaldNight, Stalker Panda 2006-Apr 2021
  Earth Krahang 2022  
  Earth Lusca 2019-Sep 2024  
  Icefog, Dagger Panda 2011-2018/2019  
  Mustang Panda, Bronze President 2012-Jun 2025  
  RedEcho 2020  
  RedFoxtrot 2014-Aug 2021  
  RedHotel, TAG-22 2021-2022  
  Space Pirates 2017-Nov 2024  
  TAG-38 2021  
  Tonto Team, HartBeat, Karma Panda 2009-Apr 2023  
  Tropic Trooper, Pirate Panda, APT 23, KeyBoy 2011-Jun 2023  
  Velvet Ant 2023-Jul 2024  
14 groups listed (14 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=0eedd5c2-57d7-447c-954d-e0e2ade187dc
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=0eedd5c2-57d7-447c-954d-e0e2ade187dc
Page 2 of 2

Changed APT groups Name Country  Observed 
APT 41  2012-Jul 2025
 Page 1 of 2