Shadowhammer

Category: backdoor · Aliases: APT.ShadowHammer, Trojan.ASUSUpdate, Backdoor.Barium, APT41 · Sample count (EMBER 2018): 1 · Enrichment: insufficient_information · Updated: 2026-07-02T06:52:06Z

Category: BackdoorActor: Unknown / CybercriminalIndustry: Global / OpportunisticMotivation: Opportunistic

Overview

Executive Summary

Operation ShadowHammer was a highly sophisticated Advanced Persistent Threat (APT) supply chain attack discovered in 2019, attributed to the Chinese state-sponsored group Barium (also known as APT41). The attackers successfully compromised the ASUS Live Update Utility, allowing them to push cryptographically signed, weaponized software updates to hundreds of thousands of ASUS computers globally. However, the malware's payload was designed to execute only on a highly specific, pre-determined list of target machines.

Infection Vector and Technical Capabilities

The infection vector was a classic upstream supply chain compromise. The attackers breached ASUS's internal network, compromised their software build environment, and weaponized the legitimate `setup.exe` for the ASUS Live Update tool. Because the executable was signed with a legitimate ASUS digital certificate, it bypassed standard antivirus checks and was installed silently by the update utility. Once installed, ShadowHammer demonstrated extreme precision and stealth:

MAC Address Targeting: The weaponized update contained a hardcoded list of roughly 600 specific MAC addresses (hashed using MD5). Upon execution, the malware checked the victim's MAC address against this list.
Dormant vs. Active: If the MAC address did not match, the malware remained dormant, taking no malicious action to avoid raising suspicion. If the MAC address *did* match, it initiated a secondary stage.
Secondary Payload Delivery: For the targeted machines, the malware reached out to an attacker-controlled C2 server (often disguised as a legitimate ASUS domain) to download a secondary, memory-resident backdoor, providing the APT group with full remote access to the high-value target.

Threat Assessment

ShadowHammer is a masterclass in supply chain compromise and targeted espionage. The fact that the attackers could compromise a major hardware vendor's update infrastructure, sign the malware with legitimate certificates, and deploy it to half a million machines just to target 600 specific individuals highlights the extreme capability and patience of state-sponsored APT groups.

Incident Response and Remediation

Update the Update Utility: The immediate remediation for the general public was to update the ASUS Live Update utility to a new version (which included enhanced security checks) and run a diagnostic tool provided by ASUS to determine if the specific machine was targeted.
Targeted Forensics: For organizations that discovered their MAC addresses were on the target list, a "break-glass" incident response protocol was required. This necessitated a complete forensic investigation of the endpoint and the surrounding network to identify the secondary backdoors deployed by APT41 and the extent of the data exfiltration.
Zero-Trust Architecture: ShadowHammer demonstrates that even digitally signed software from trusted vendors cannot be implicitly trusted. Organizations must adopt Zero-Trust principles, heavily monitoring endpoint behavior (EDR) rather than relying solely on signature-based or certificate-based trust models.

Known aliases

Threat reports may refer to this family under multiple names:

MITRE ATT&CK Techniques

This family has been observed using the following ATT&CK techniques: T1195.002 T1553.002 T1016 T1105

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

T1105: Implement network intrusion detection systems (NIDS) and host-based firewalls to block unauthorized inbound or outbound file transfers.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_SHADOWHAMMER {
    meta:
        description = "Detects Shadowhammer (backdoor)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "shadowhammer" ascii wide nocase
        $s2 = "apt.shadowhammer" ascii wide nocase
        $s3 = "trojan.asusupdate" ascii wide nocase
        $s4 = "backdoor.barium" ascii wide nocase
        $s5 = "apt41" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Shadowhammer Activity
id: 6ec1300e66a0d9f796c3eea828c1e5ca
status: experimental
description: Detects generic indicators of the shadowhammer malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*shadowhammer*"
            - "*apt.shadowhammer*"
            - "*trojan.asusupdate*"
            - "*backdoor.barium*"
            - "*apt41*"
    condition: selection
level: medium

References & External Analysis

Search "shadowhammer" on VirusTotal (External Analysis)

Frequently Asked Questions

How do I remove the Shadowhammer Backdoor from Windows?

Manual removal of Shadowhammer is highly discouraged as it may leave persistence mechanisms intact. We recommend disconnecting the device from the internet and utilizing a professional incident response service or enterprise-grade EDR software to conduct a full forensic sweep.

Is Shadowhammer a virus or a Backdoor?

Shadowhammer is classified as a Backdoor. Unlike traditional viruses that infect files, modern malware like Shadowhammer typically operates as a standalone payload designed to compromise systems, steal data, or deploy secondary stage implants.

What are the main symptoms of a Shadowhammer infection?

Symptoms of Shadowhammer can include unexpected system slowness, unauthorized outbound network traffic to unknown IP addresses, disabled security software, and suspicious background processes running from AppData or Temp directories.

Related Families (Category: backdoor)

Explore other malware families in the same category:

Protect Your Network Against Backdoors

Want to prevent Shadowhammer and similar threats from compromising your organization? Read our comprehensive defensive guide: Backdoor & RAT Protection.

Need help with an active incident? Published by the SystemHelpdesk team.

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/shadowhammer.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.