Technical Profile
Initial Discovery and Capabilities
The threat group first came to public attention in February 2025 through coordinated reporting by Elastic Security Labs and Palo Alto Networks Unit 42. Researchers documented the group’s deployment of FINALDRAFT (also known as Squidoor), a sophisticated backdoor capable of compromising both Windows and Linux environments. More recently, investigators have linked Ink Dragon to a five-month intrusion campaign against a Russian IT service provider.
Attack Methodology
Ink Dragon’s intrusion chains begin by exploiting vulnerabilities in internet-facing web applications. Once initial access is achieved, attackers deploy web shells that serve as staging points for subsequent payloads. These include VARGEIT malware and Cobalt Strike beacons, which enable the full spectrum of post-exploitation activities: command-and-control communications, network reconnaissance, lateral movement, defense evasion, and data theft.
Malware Evolution
Analysis reveals that FINALDRAFT and VARGEIT, previously thought to be distinct tools, actually represent different stages in the evolution of a single malware family. VARGEIT appears to be an earlier iteration, while FINALDRAFT represents a more sophisticated, feature-rich version deployed in recent operations.
Advanced Exploitation Techniques
ViewState Deserialization Attacks
A key component of Ink Dragon’s methodology involves exploiting predictable or poorly managed ASP.NET machine key values. By leveraging these weaknesses, the group executes ViewState deserialization attacks against vulnerable IIS and SharePoint servers. Following successful exploitation, attackers install a custom ShadowPad IIS Listener module that transforms compromised servers into nodes within their command-and-control infrastructure.
This architecture enables attackers to proxy commands and network traffic through victim systems, significantly enhancing operational resilience. The design allows for traffic routing not only within a single compromised organization but across entirely separate victim networks. This means one successful breach can become a relay point supporting operations against other targets, effectively creating a global, multi-layered infrastructure built on previously compromised assets.
The listener module provides extensive control over infected IIS machines, enabling reconnaissance activities and payload staging operations.
Additional Exploitation Vectors
Beyond ASP.NET machine key exploitation, Ink Dragon has weaponized ToolShell SharePoint vulnerabilities to deploy web shells on targeted servers.
Operational Tactics
Lateral Movement and Persistence
The group employs multiple techniques to maintain access and expand its foothold within compromised networks:
Attackers leverage extracted IIS machine keys to obtain local administrative credentials, which are then used for lateral movement via RDP tunnels. To ensure persistent access, they create scheduled tasks and install system services. Privilege escalation is achieved through LSASS memory dumps and registry hive extraction. Additionally, the group modifies host firewall configurations to permit outbound traffic, effectively transforming infected systems into relay nodes within their ShadowPad network.
Advanced Credential Exploitation
In one documented incident, Ink Dragon demonstrated sophisticated credential theft capabilities. The group discovered an idle RDP session belonging to a Domain Administrator who had authenticated using Network Level Authentication (CredSSP) with NTLMv2 fallback. Because the session remained disconnected rather than properly logged off, LSASS retained the associated logon token and NTLM verifier in memory.
After obtaining SYSTEM-level access to the host, attackers extracted the token and potentially the NTLM key material. They then reused these credentials to perform authenticated SMB operations, enabling them to write to administrative shares and exfiltrate NTDS.dit and registry hives. This marked the point where Ink Dragon achieved domain-wide privilege escalation and complete network control.
Malware Arsenal
Rather than relying on a single backdoor or monolithic framework, Ink Dragon’s intrusions utilize multiple specialized components to establish and maintain long-term persistence:
ShadowPad Loader decrypts and executes the ShadowPad core module directly in memory. CDBLoader leverages Microsoft Console Debugger (“cdb.exe”) to run shellcode and load encrypted payloads. LalsDumper extracts LSASS memory dumps for credential harvesting. 032Loader handles decryption and execution of various payloads. FINALDRAFT serves as an updated remote administration tool that abuses Microsoft Outlook and the Graph API for command-and-control communications.
FINALDRAFT implements a modular command framework where operators push encoded command documents to the victim’s email mailbox. The implant then retrieves, decrypts, and executes these commands, providing a stealthy communication channel that leverages legitimate services.
Overlapping Intrusions
Investigators have detected evidence of a second threat actor, REF3927 (also known as RudePanda), operating within several of the same environments compromised by Ink Dragon. Currently, there are no indications of operational collaboration between these two groups. Instead, it appears both intrusion sets independently exploited the same initial access vulnerabilities to establish their footholds.
Defensive Implications
Ink Dragon’s operations represent a significant evolution in threat actor methodology. Security teams must reconceptualize intrusions not merely as isolated breaches but as potential nodes within an attacker-managed ecosystem. Eliminating a single compromise point proves insufficient unless defenders can identify and dismantle the entire relay chain.
The group’s relay-centric architecture represents one of the most mature implementations of ShadowPad infrastructure observed to date. Essentially, Ink Dragon has created a blueprint for sustained, multi-organizational access built upon the victims’ own compromised infrastructure. This approach ensures operational continuity and resilience, making detection and remediation significantly more challenging for defensive teams.