Could this breach have been prevented?

Robust zero trust segmentation, real-time anomaly detection, and encrypted traffic inspection could have limited lateral movement and improved detection of advanced malware operations.

What malware families were used by Ink Dragon in this campaign?

Threat actors deployed both ShadowPad and FINALDRAFT malware, leveraging their modular nature for persistent access and covert data exfiltration.

China-Linked Ink Dragon Breaches Governments With ShadowPad and FINALDRAFT Malware

A coordinated cyber-espionage campaign by Ink Dragon compromised multiple government networks across Europe, Southeast Asia, and South America in 2025 using sophisticated malware and lateral movement tactics.

Published: January 10, 2026

Share this on:

Executive Summary

Between July and October 2025, a sophisticated cyber-espionage campaign orchestrated by the China-linked group 'Ink Dragon' (a.k.a. Jewelbug, CL-STA-0049, Earth Alux, REF7707) targeted multiple European, Southeast Asian, and South American governments. The attackers leveraged advanced tools such as ShadowPad and FINALDRAFT malware to infiltrate official networks, move laterally through compromised systems, and exfiltrate sensitive government data via encrypted channels. Their operations exhibited a high degree of stealth, blending custom malware with legitimate administrative tools and exploiting trust in east-west network flows, putting confidential geopolitical and citizen information at direct risk.

This incident underscores the increasing frequency and sophistication of state-sponsored espionage operations against government entities worldwide. It marks a significant trend where threat actors are adopting modular malware and advanced lateral movement techniques, emphasizing the urgent need for stronger east-west security controls and real-time anomaly detection in critical infrastructure.

Why This Matters Now

The Ink Dragon breach highlights the escalating threat from nation-state actors targeting government digital infrastructure with advanced malware and encrypted data exfiltration techniques. As attackers evolve to exploit blind spots in east-west traffic and privileged network access, organizations must rapidly improve segmentation, monitoring, and response capabilities before similar threats escalate beyond the public sector.

Attack Path Analysis

The Ink Dragon threat actor likely initiated access to government cloud environments using spear-phishing or stolen credentials to deploy ShadowPad and FINALDRAFT malware. After foothold, attackers escalated their privileges within cloud services to gain broader permissions. Leveraging internal east-west communications, they maneuvered laterally across workloads, identifying new targets. For command and control, encrypted channels and covert protocols enabled persistent communication with external infrastructure. Sensitive government data was exfiltrated using outbound connections disguised as legitimate traffic. The operation aimed for covert and continuous espionage with minimal direct disruption, but risked long-term impact on data confidentiality and government operations.

Kill Chain Progression

Initial Compromise

Mediuminferred

Privilege Escalation

Medium

Lateral Movement

Medium

Command & Control

Medium

Exfiltration

Medium

Impact

Medium

Initial Compromise

Description

Adversaries gained initial access to government cloud environments, likely via spear-phishing, credential theft, or exploitation of exposed remote services.

Confidence:

Medium

Related CVEs

Included CVEs with severity scores, affected products, exploit status, and reference links.

CVE-2017-11882
CVSS 7.8
A memory corruption vulnerability in Microsoft Office allows remote code execution when the software fails to properly handle objects in memory.
Affected Products:
Microsoft Office – 2007 SP3, 2010 SP2, 2013 SP1, 2016
Exploit Status:
exploited in the wild
References:
https://nvd.nist.gov/vuln/detail/CVE-2017-11882 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11882
CVE-2018-0802
CVSS 7.8
A memory corruption vulnerability in Microsoft Office allows remote code execution when the software fails to properly handle objects in memory.
Affected Products:
Microsoft Office – 2007 SP3, 2010 SP2, 2013 SP1, 2016
Exploit Status:
exploited in the wild
References:
https://nvd.nist.gov/vuln/detail/CVE-2018-0802 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0802

MITRE ATT&CK® Techniques

Initial Access

T1566

Phishing

Persistence

T1078

Valid Accounts

Execution

T1059

Command and Scripting Interpreter

Command and Control

T1105

Ingress Tool Transfer

Command and Control

T1071

Application Layer Protocol

Defense Evasion

T1027

Obfuscated Files or Information

Collection

T1005

Data from Local System

Exfiltration

T1041

Exfiltration Over C2 Channel

Potential Compliance Exposure

Mapping incident impact across multiple compliance frameworks.

PCI DSS 4.0 – User Identification and Authentication

Control ID: 8.2.2

The compromise of valid accounts and use of malware indicate weaknesses in user authentication and access management, potentially bypassing multi-factor authentication requirements.

NYDFS 23 NYCRR 500 – Cybersecurity Policy

Control ID: 500.03

Failure to prevent advanced threat actor access illustrates insufficiently robust cybersecurity policies covering malware defense and incident detection.

DORA – ICT Risk Management Framework

Control ID: Art. 9

Successful government-focused attacks highlight inadequate ICT risk management procedures for detecting and mitigating persistent cyber threats.

CISA Zero Trust Maturity Model 2.0 – Identity Authentication and Access Controls

Control ID: Identity – Authentication and Access Control

The use of valid accounts and advanced malware demonstrates gaps in strong identity verification, account monitoring, and Zero Trust controls.

NIS2 Directive – Cybersecurity Risk Management Measures

Control ID: Art. 21

The threat actor's persistence and exfiltration activities reveal exposure due to insufficient technical and organizational risk mitigation measures, including malware protection and detection capabilities.

Sector Implications

Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.

Government Administration

Primary target of China-linked Ink Dragon cyber espionage campaign using ShadowPad and FINALDRAFT malware, requiring enhanced encrypted traffic monitoring and zero trust segmentation controls.

Information Technology/IT

Critical infrastructure vulnerabilities exposed through lateral movement attacks, necessitating east-west traffic security, threat detection systems, and inline IPS protection against advanced persistent threats.

Telecommunications

High-value espionage targets vulnerable to encrypted traffic interception and data exfiltration, requiring multicloud visibility, egress security controls, and anomaly detection capabilities for protection.

Financial Services

Elevated cyber espionage risk from state-sponsored actors targeting sensitive financial data, demanding cloud firewall protection, secure hybrid connectivity, and comprehensive threat intelligence integration.

Sources

China-Linked Ink Dragon Hacks Governments Using ShadowPad and FINALDRAFT Malwarehttps://thehackernews.com/2025/12/china-linked-ink-dragon-hacks.html
Verified

ShadowPad, Software S0596 | MITRE ATT&CK®https://attack.mitre.org/software/S0596/

Verified

Indian Critical Infrastructure Intrusions, Campaign C0043 | MITRE ATT&CK®https://attack.mitre.org/campaigns/C0043/

Verified

RedEcho, Group G1042 | MITRE ATT&CK®https://attack.mitre.org/groups/G1042/

Verified

Frequently Asked Questions

The breach revealed weaknesses in east-west traffic monitoring, insufficient segmentation, and inadequate visibility over encrypted malicious activity in government networks.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Robust Zero Trust segmentation, east-west traffic controls, egress policy enforcement, and visibility offered by CNSF-aligned cloud network controls would have constrained attacker movement, limited C2 activity, and raised detection opportunities early in the kill chain.

Initial Compromise

Control: Multicloud Visibility & Control

Mitigation: Early detection of abnormal access attempts and policy violations.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Restricted privilege boundaries and identity-based segmentation limit potential for privilege abuse.

Lateral Movement

Control: East-West Traffic Security

Mitigation: Blocked unauthorized east-west movements between sensitive zones.

Command & Control

Control: Egress Security & Policy Enforcement

Mitigation: Prevented unapproved outbound traffic and enforced protocol restrictions.

Exfiltration

Control: Encrypted Traffic (HPE)

Mitigation: Visibility into encrypted data flows and enforcement of data-in-transit protection.

Impact (Mitigations)

Rapid detection and response to ongoing attacker presence and suspicious behaviors.

Impact at a Glance

Affected Business Functions

Government Operations
National Security

Operational Disruption

Estimated downtime: 7 days

Financial Impact

Estimated loss: $5,000,000

Data Exposure

Potential exposure of sensitive government communications and classified information.

Recommended Actions

• Deploy Zero Trust segmentation and identity-based access controls to restrict lateral movement within cloud environments.
• Implement continuous east-west traffic monitoring and microsegmentation to detect and prevent unauthorized internal traversal.
• Enforce strict egress filtering and FQDN-based policy enforcement to block C2 and exfiltration attempts.
• Utilize centralized multicloud visibility for proactive anomaly detection and real-time threat response.
• Ensure high-performance, line-rate encryption protects all sensitive data in transit and monitor for unauthorized outbound flows.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced Threats Get a Free Workload Attack Path Assessment Under Active Attack?

China-Linked Ink Dragon Breaches Governments With ShadowPad and FINALDRAFT Malware

Executive Summary

Why This Matters Now

Attack Path Analysis

Kill Chain Progression

Initial Compromise

Description

Related CVEs

CVE-2017-11882

Affected Products:

Exploit Status:

References:

CVE-2018-0802

Affected Products:

Exploit Status:

References:

MITRE ATT&CK® Techniques

Phishing

Valid Accounts

Command and Scripting Interpreter

Ingress Tool Transfer

Application Layer Protocol

Obfuscated Files or Information

Data from Local System

Exfiltration Over C2 Channel

Potential Compliance Exposure

PCI DSS 4.0 – User Identification and Authentication

NYDFS 23 NYCRR 500 – Cybersecurity Policy

DORA – ICT Risk Management Framework

CISA Zero Trust Maturity Model 2.0 – Identity Authentication and Access Controls

NIS2 Directive – Cybersecurity Risk Management Measures

Sector Implications

Government Administration

Information Technology/IT

Telecommunications

Financial Services

Sources

Frequently Asked Questions

Cloud Native Security Fabric Mitigations and ControlsCNSF

Impact at a Glance

Affected Business Functions

Recommended Actions

Key Takeaways & Next Steps

Secure the Paths Between Cloud Workloads