Winnti Group targeting universities in Hong Kong

ESET researchers reported a targeted Winnti Group campaign (Nov 2019) against Hong Kong universities deploying a new ShadowPad launcher alongside Winnti implants; the analysis covers DLL side‑loading (hpqhvsei.dll/hpqhvind.exe), XOR payload decryption, modular ShadowPad capabilities (including a keylogger and persistence as a fake .NET optimization service), C2 naming patterns tied to targeted universities, and provides IoCs and MITRE ATT&CK mappings.