Reddit NetSec

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

CIRCL OSINT Feed

ThreatFox MISP Feed

CVE Database V5

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The TA-ShadowCricket group, formerly known as Shadow Force, has been active in the Asia-Pacific region since 2012, targeting Windows servers and MS-SQL servers. They operate an IRC server with over 2,000 affected IPs in 72 countries. The group uses various malware and tools, including Upm, SqlShell, Maggie, and Wgdrop. Their activities involve three stages: initial access and reconnaissance, backdoor deployment, and additional malicious behaviors. The group has connections to China and has been quietly stealing information for over 13 years without demanding ransom or releasing stolen data. Their persistent activity suggests preparation for potential large-scale attacks in the future.

TA-ShadowCricket, previously known as Shadow Force, is an advanced persistent threat (APT) group active since 2012, primarily targeting Windows servers and Microsoft SQL (MS-SQL) servers. The group operates an IRC server infrastructure controlling over 2,000 infected IP addresses across 72 countries, indicating a broad global footprint. Their malware toolkit includes several specialized tools such as Upm, SqlShell, Maggie, and Wgdrop, which facilitate multi-stage operations. The attack lifecycle consists of initial access and reconnaissance, followed by backdoor deployment, and culminating in additional malicious activities such as credential theft, lateral movement, and possibly cryptomining. Notably, TA-ShadowCricket has maintained a low profile by quietly exfiltrating sensitive information without engaging in ransom demands or public data leaks, suggesting a strategic intent to build long-term access for potential future large-scale operations. The group’s ties to China and their sustained activity over more than a decade underscore their persistence and sophistication. The use of IRC for command and control (C2) is a classic technique that enables stealthy communications and botnet management. The threat leverages multiple MITRE ATT&CK techniques including credential dumping (T1003), persistence (T1543), remote services exploitation (T1021.001), and obfuscated files or information (T1027), among others, highlighting a comprehensive and adaptable attack methodology. Despite no known public exploits currently in the wild, the extensive infection base and the variety of tools employed make this a significant threat to organizations running vulnerable Windows and MS-SQL server environments.

Detailed information about TA-ShadowCricket: Emerging Malware Trends and IRC Server Tracking. Get real-time updates, technical details, and mitigation strategie

Title	Severity	Type	Source	Date

Threats Tagged 'windows servers'

Filter Threats

Threats Tagged 'windows servers'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility