Symantec: Chinese cyberespionage group Redfly used the ShadowPad trojan to hack a national electricity grid company in Asia from February 28 to August 3, 2023
An espionage threat group tracked as ‘Redfly’ hacked a national electricity grid organization in Asia and quietly maintained access to the breached network for six months.
Context & Ripple Effects
This report extends a related pattern of espionage activity against Asian organizations: Symantec had earlier described Lancefly targeting Asian governments and telecoms with custom malware.
Its focus on a grid operator also echoes the earlier penetration of energy companies' operational networks, making long-lived access—not merely initial compromise—the central risk.
First-order effects
- The affected grid organization must identify and remove any remaining ShadowPad-related persistence, then determine whether the intrusion reached systems connected to electricity operations.
- Symantec's disclosure gives grid-sector defenders a concrete malware and intrusion pattern to hunt for across their own environments.
Second-order effects
- Other electricity operators and their managed-service providers are likely to prioritize searches for ShadowPad and review monitoring coverage across corporate and operational-network boundaries.
- Security vendors and incident-response teams gain a clearer basis for tuning detections around a campaign that maintained access over an extended period.
Third-order effects
- If similar intrusions continue, critical-infrastructure defense will increasingly depend on ecosystem-wide detection and response, rather than treating each utility's enterprise network as an isolated security perimeter.
- The case reinforces a durable shift toward measuring resilience by attackers' ability to persist undetected in critical environments, not just by whether an initial intrusion is blocked.
The trend: Cyberespionage campaigns are putting greater strategic value on durable, covert access to critical-infrastructure networks, raising the importance of coordinated ecosystem cyber defense.