Shadowpad

Seven-implant Linux toolkit intercepts traffic on compromised routers, delivering ShadowPad and hijacking Android updates. Active C2 infrastructure dates to 2019.

Sophisticated threat group escalates operations against European government entities using relay networks that route attacks through multiple victim organizations.