Ink Dragon, a Chinese threat actor, is conducting a sophisticated espionage campaign targeting government entities in Europe, Southeast Asia, and South America. The group exploits IIS misconfigurations to gain initial access and deploys a custom ShadowPad IIS Listener module to create a victim-based relay network, turning compromised servers into nodes of a distributed mesh. They use a new variant of the FinalDraft malware and platform-native tools to maintain stealth and blend into normal enterprise telemetry. Their operations are characterized by disciplined playbooks and advanced software engineering, enabling persistent and covert intrusions. The campaign poses a medium severity threat due to its targeted nature and stealth capabilities, with no known public exploits yet. European organizations, especially government sectors running IIS servers with potential misconfigurations, are at risk. The threat actor’s relay network complicates detection and response efforts, increasing the potential impact on confidentiality and operational integrity. Mitigation requires focused IIS hardening, network segmentation, and advanced telemetry analysis to detect anomalous relay behaviors.
