Shadow Network

Linked to China by one source.

Reports: 2
Last reported: 6 April 2026
Known CVEs: 1
Origin: China

ID: shadow-network
Sources: MISP ETDA Malpedia
Merge evidence: 2 alias matches

Reports per quarter

2010 Q2: 1 report
2010 Q3: no reports
2010 Q4: no reports
2011 Q1: no reports
2011 Q2: no reports
2011 Q3: no reports
2011 Q4: no reports
2012 Q1: no reports
2012 Q2: no reports
2012 Q3: no reports
2012 Q4: no reports
2013 Q1: no reports
2013 Q2: no reports
2013 Q3: no reports
2013 Q4: no reports
2014 Q1: no reports
2014 Q2: no reports
2014 Q3: no reports
2014 Q4: no reports
2015 Q1: no reports
2015 Q2: no reports
2015 Q3: no reports
2015 Q4: no reports
2016 Q1: no reports
2016 Q2: no reports
2016 Q3: no reports
2016 Q4: no reports
2017 Q1: no reports
2017 Q2: no reports
2017 Q3: no reports
2017 Q4: no reports
2018 Q1: no reports
2018 Q2: no reports
2018 Q3: no reports
2018 Q4: no reports
2019 Q1: no reports
2019 Q2: no reports
2019 Q3: no reports
2019 Q4: no reports
2020 Q1: no reports
2020 Q2: no reports
2020 Q3: no reports
2020 Q4: no reports
2021 Q1: no reports
2021 Q2: no reports
2021 Q3: no reports
2021 Q4: no reports
2022 Q1: no reports
2022 Q2: no reports
2022 Q3: no reports
2022 Q4: no reports
2023 Q1: no reports
2023 Q2: no reports
2023 Q3: no reports
2023 Q4: no reports
2024 Q1: no reports
2024 Q2: no reports
2024 Q3: no reports
2024 Q4: no reports
2025 Q1: no reports
2025 Q2: no reports
2025 Q3: no reports
2025 Q4: no reports
2026 Q1: no reports
2026 Q2: 1 report

Dated reports, 2010 Q2 to 2026 Q2.

CVEs named in reports

CVE-2009-0927 KEV

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

6 April 2026

Shadow Network - Threat Group Cards: A Threat Actor Encyclopedia

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Shadow Network - Threat Group Cards: A Threat Actor Encyclopedia
6 April 2010

Shadows In The Cloud: Investigating Cyber Espionage 2.0

Malpedia library date Shadowserver, Information warfare monitor fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Shadows In The Cloud: Investigating Cyber Espionage 2.0

Newest first. Details opens the report in Explore.

Names and who uses them

Shadow Network from MI ET MA

AT ATT&CK
MI MISP
ET ETDA
MA Malpedia

Origin and Motivation

Origin: China fromETDA
Motivation: Information theft and espionage fromETDA

Claimed targets (actor-level, per source)

Sources give these for the actor as a whole, not for a report or campaign.

Countries: Afghanistan fromETDA
Australia fromETDA
Azerbaijan fromETDA
Canada fromETDA
China fromETDA
France fromETDA
Germany fromETDA
Greece fromETDA
Hong Kong fromETDA
India fromETDA
Israel fromETDA
Italy fromETDA

Show all 33 countries Show fewer

Japan fromETDA
Lithuania fromETDA
Malaysia fromETDA
Mexico fromETDA
Nepal fromETDA
Netherlands fromETDA
New Zealand fromETDA
Pakistan fromETDA
Papua New Guinea fromETDA
Philippines fromETDA
Qatar fromETDA
Romania fromETDA
Russia fromETDA
South Korea fromETDA
Sweden fromETDA
Taiwan fromETDA
Thailand fromETDA
United Arab Emirates fromETDA
United Kingdom fromETDA
United States fromETDA
Vietnam fromETDA
Sectors: Education fromETDA
Government fromETDA