ESET Research published a technical analysis on ESET (WeLiveSecurity) of a Winnti Group campaign discovered in November 2019 against at least two — and likely five — Hong Kong universities, occurring in the context of the 2019 pro-democracy protests where university campuses served as protest centers. The campaign used a new ShadowPad launcher and a co-deployed Winnti malware implant, with both backdoors containing campaign identifiers and C2 URLs derived from target university names.
New ShadowPad Launcher: HP Digital Imaging DLL Sideloading and Parent Process Patching at Offset 0x10BA
Unlike prior ShadowPad variants, the new 32-bit launcher (hpqhvsei.dll) is not VMProtect-obfuscated, does not store payload in the PE overlay or a COM1:NULL.dat alternate data stream, and omits the volume-ID-derived RC5 encryption seen in PortReuse and skip-2.0. The malicious DLL hijacks the legitimate HP Digital Imaging binary hpqhvind.exe via DLL sideloading from C:\Windows\Temp\. On load, DLLMain checks the parent process for the byte sequence 85 C0 0F 84 (test eax,eax / jz) at offset 0x10BA; if matched (confirming the parent is hpqhvind.exe), it patches those bytes to an unconditional jmp (0xE9) redirecting execution to the DLL's payload decryption function. The encrypted payload sits in the .rdata section and is decrypted via a rolling XOR loop with an iteratively updated key, producing ShadowPad's shellcode initialization stub (obfuscated with fake conditional jumps). The patched hpqhvind.exe is written to C:\ProgramData\DRM\CLR\CLR.exe and a persistence service named clr_optimization_v4.0.30229_32 is created — mimicking the legitimate Microsoft .NET optimization service name.
ShadowPad Configuration and C2: University Campaign IDs, dnslookup.services Domains, and wmplayer.exe Injection
The 2180-byte encrypted configuration string pool (decrypted field-by-field, never fully in memory simultaneously) includes the targeted university name as the campaign ID at offset 0x99, persistence paths, the service name, and C2 URLs following the scheme [backdoor_type][university_name].domain.tld:443 — where b prefixes ShadowPad C2s (e.g., b[university].dnslookup.services:443) and w prefixes Winnti C2s (e.g., w[university].livehost.live:443 or w[university].dnslookup.services:443). This URL format enabled ESET to identify three additional likely-compromised Hong Kong universities. ShadowPad injects into a hidden suspended wmplayer.exe process for C2 communications and opens inbound TCP port 13567 by writing a firewall rule to the registry at HKLM\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\.
17-Module ShadowPad: Default Keylogging, ImpUser Token Duplication, and Notable "Servcie" Typo
This variant embeds 17 modules (vs. 8–10 in prior documented variants), all compiled within a tight timestamp window on October 24, 2019, suggesting a build framework. Modules include: Root (100), Plugins (101), Config (102), Install (103), Online (104), ImpUser (106, user impersonation via token duplication), TCP (200), HTTPS (202), Pipe (207), Disk (300), Process (301), Servcie (302 — notable developer typo), Register (303), Shell (304), Keylogger (306), Screen (307), and RecentFiles (317). The Keylogger module is active by default, writing every keystroke encrypted to %APPDATA%\PAGM\OEY\XWWEYG\WAOUE — a notable shift from prior ShadowPad variants that did not embed the keylogger at all. The Winnti malware (C:\Windows\System32\oci.dll, Win64/Winnti.CA) was present on affected machines approximately two weeks prior to ShadowPad deployment.