MalwarePublished 27 May 2025Updated 26 Jun 2025

TA-ShadowCricket: Emerging Malware Trends and IRC Server Tracking

Source AlienVault OTX General

Description

The TA-ShadowCricket group, formerly known as Shadow Force, has been active in the Asia-Pacific region since 2012, targeting Windows servers and MS-SQL servers. They operate an IRC server with over 2,000 affected IPs in 72 countries. The group uses various malware and tools, including Upm, SqlShell, Maggie, and Wgdrop. Their activities involve three stages: initial access and reconnaissance, backdoor deployment, and additional malicious behaviors. The group has connections to China and has been quietly stealing information for over 13 years without demanding ransom or releasing stolen data. Their persistent activity suggests preparation for potential large-scale attacks in the future.

Impact

For European organizations, the TA-ShadowCricket threat poses a substantial risk, particularly to enterprises and institutions relying on Windows server infrastructure and MS-SQL databases. The group’s capability to stealthily exfiltrate data over extended periods can lead to significant confidentiality breaches, including theft of intellectual property, sensitive customer data, and internal credentials. This can result in reputational damage, regulatory penalties under GDPR, and potential financial losses. The presence of backdoors and botnet control mechanisms also raises the risk of these compromised systems being leveraged for further attacks, such as distributed denial-of-service (DDoS) campaigns or as pivot points for lateral movement within networks. The lack of ransom demands suggests the group’s intent is espionage or strategic data collection, which can be particularly concerning for sectors like finance, government, critical infrastructure, and technology firms in Europe. Additionally, the cryptomining activities could degrade system performance and increase operational costs. The persistent nature of the threat indicates that infected systems may remain compromised for long durations if undetected, amplifying the potential damage.

Defensive guidance

European organizations should implement targeted defenses beyond generic best practices. First, conduct comprehensive network and endpoint monitoring specifically for IRC traffic anomalies, as IRC is uncommon in modern enterprise environments and may indicate C2 activity. Deploy advanced threat detection solutions capable of identifying the specific malware families (Upm, SqlShell, Maggie, Wgdrop) and associated behaviors such as unusual SQL queries or backdoor activity. Harden MS-SQL servers by disabling unused features, enforcing least privilege access, and applying strict authentication controls including multi-factor authentication (MFA) for administrative accounts. Regularly audit and rotate credentials, especially those with elevated privileges, to mitigate credential theft risks. Employ network segmentation to limit lateral movement opportunities and isolate critical assets. Utilize threat intelligence feeds to update detection signatures and indicators of compromise related to TA-ShadowCricket. Conduct periodic penetration testing and red team exercises simulating similar attack vectors to assess resilience. Finally, establish incident response plans that include forensic capabilities to detect and remediate long-term stealthy intrusions.

Indicators of compromise

Domains 3

abc.itembuy.org
irc.itembuy.org
www.itembuy.org

IP addresses 5

1.234.4.115
114.202.2.32
121.178.180.210
210.127.211.40
211.204.100.20

Hashes 15

0b6ac1e20c828eae2fdc3b702118c856
1579fc385238ce366ee137aaf91a50dd
189e46f458a3d460367133022634a5df
2dec0626f227d32cca17bce5f772a286
3c91f2ef60966e483a16224bf8823d0b
7700250eff4fcd264267672cdf7499c9b6bb0413
8613948d7ab03738ba3ba3532b75834e9402c9f0
8c66b954c109ddff7e9807f3b080ba1b16241dec
c87eaf7effd48649f83dfaa52c8daf1f2c33ed6b
f959cdaf7f5e8a57fc07d4b9632aa2bab3a3f615

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 27 Jun 2025, 09:35 UTC

MITRE ATT&CK techniques19 from threat tags

Technical details

Indicators of compromise

Domains 3

IP addresses 5

Hashes 15

Community reviews

Related threats