Study of the ShadowPad APT backdoor and its relation to PlugX

This Doctor Web technical report analyzes multiple ShadowPad backdoor variants found on a compromised Kyrgyzstan state institution, compares code and operational similarities with PlugX (suggesting shared authorship or code reuse likely tied to Chinese APT activity such as Winnti), documents multi-module loaders, plugin formats, persistence and network behaviors (TCP/HTTP/DNS/UDP), provides implementation-level pseudocode and decryption routines, and lists IOCs (hashes, domains, IPs) for detection and response.