ShadowGate
ShadowGate is a cybercrime syndicate with a financial motive, tracked by Brandefense. It targets organisations in South Korea. It uses 9 MITRE ATT&CK techniques.
Also known as
- WordsJS
- Techniques
- 9
- Exploited CVEs
- No CVE data
- First seen
- Jun 27, 2019
- Last seen
- Jun 27, 2019
- Record updated
Who They Target.
Countries · 1
How They Operate · MITRE ATT&CK.
9 techniques across 5 of 14 tacticsResource Development·
Initial Access3
T1189
Drive-by Compromise
Drive-by Compromise
T1190
Exploit Public-Facing Application
Exploit Public-Facing Application
T1203
Exploitation for Client Execution
Exploitation for Client Execution
Execution1
T1059.001
Command and Scripting Interpreter: PowerShell
Command and Scripting Interpreter: PowerShell
Persistence·
Privilege Escalation·
Defense Evasion1
T1027
Obfuscated Files or Information
Obfuscated Files or Information
Credential Access·
Lateral Movement·
Collection·
Command and Control·
Exfiltration·
Impact·
Arsenal · Malware And Tools.
- Greenflash Sundownmalware
Campaigns.
- ShadowGateJun 2019
About ShadowGate.
A financially motivated cybercriminal group active since 2015 known for malvertising attacks and developing the proprietary Greenflash Sundown exploit kit.
Last updated Oct 19, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.