Shell Crew's Zero-Detection C2 and Anti-Forensic Toolkit Hit Mexico Construction

A Zero-Detection C2 Node and a Toolkit Built to Outlast the Forensics

Five hacktools attributed to Shell Crew — the Chinese state-aligned intrusion set also tracked as Deep Panda, APT26, Turbine Panda, and Checkered Typhoon — have been linked to an active espionage campaign targeting Mexico's construction sector, with a command-and-control node on China Unicom's commercial backbone that registered zero detections across 91 VirusTotal engines despite carrying a named-actor attribution. The operational picture that emerges from CTX Team's analysis is less about the tools themselves and more about the discipline layered around them: sandbox timing checks, Windows event-log erasure, file deletion, and timestamp manipulation combine into an anti-forensic posture that appears engineered to survive incident response rather than merely evade initial detection. The same collection also carries data-destruction and service-stop capabilities alongside its espionage mandate — a pairing that suggests the operator has pre-positioned for disruptive action if collection objectives are threatened.

The campaign was first observed in CTX Team's telemetry on 10 January 2026 and remained active through 10 June 2026, a five-month window that itself speaks to operational persistence. The confidence level on the overall assessment sits at medium-low: the five file-side components carry no VirusTotal enrichment, leaving the network node as the only verifiable infrastructure artefact in the collection. Every behavioural claim about the files rests on MITRE technique tag metadata rather than direct sandbox observation. That constraint is noted throughout what follows; it does not diminish the significance of what the network-side evidence reveals, but it does mean the file-level picture is inferred rather than observed.

---

The Evasion Stack: How the Toolset Is Built to Disappear

The defining characteristic of this campaign is not a novel delivery mechanism or an unusual payload — it is the systematic, layered effort to ensure that once the toolset has run, as little forensic residue as possible survives to tell the story.

The five file components are tagged with masquerading sub-techniques T1036.001 (invalid code signing) and T1036.007 (double file extension), alongside the broader T1036 masquerading technique and the "hacktool" classification. The combination suggests the files are purpose-built offensive utilities designed to impersonate legitimate binaries or system tools — presenting a benign surface to endpoint controls while carrying offensive capability underneath. The invalid-code-signing tag (T1036.001) is particularly notable: it indicates the files may carry signatures that appear valid at a glance but fail cryptographic verification, a technique that exploits the gap between signature presence and signature validity in some endpoint configurations. Because no file metadata is available for any of the five SHA256s, the specific masquerading method cannot be confirmed from the current evidence; the assessment rests on the MITRE tag combination and the "hacktool" classification.

Before the primary payload executes, the toolset appears to perform environmental reconnaissance designed to detect analysis environments. Time-based sandbox evasion [T1497.003] is listed in the threat metadata — a technique in which the implant introduces deliberate delays or checks elapsed wall-clock time against expected execution windows, suppressing malicious behaviour if the timing profile suggests a sandbox rather than a live host. This is paired with process enumeration [T1057] and Windows Registry querying [T1012], which together allow the toolset to profile the target environment and shape follow-on actions: if the process list or registry contents suggest a security research context, the implant can stand down before exposing its capabilities to automated analysis. The practical consequence is that sandbox-based detection pipelines — which rely on observing behaviour within a constrained time window — may see nothing at all from these components.

Once the toolset determines it is running on a genuine target, the indicator-removal suite activates in parallel with execution. Windows event logs are cleared [T1070.001], removing the audit trail that incident responders would normally use to reconstruct attacker activity. Files are deleted [T1070.004], eliminating dropped components after they have served their purpose. Timestamps are manipulated [T1070.006] — a technique known as timestomping — to make files that were recently written appear to have existed for months or years, disrupting timeline reconstruction. The analyst has flagged this cluster explicitly as the "Defense evasion and indicator suppression (MITRE T1070 family)" tradecraft signal, and it is the most operationally coherent element of the dataset: three distinct indicator-removal sub-techniques operating in concert represent a deliberate anti-forensic discipline rather than incidental cleanup.

The combined effect of this evasion architecture — sandbox timing checks before execution, indicator removal during and after — is a toolset that is designed to be difficult to catch at the detection stage and difficult to reconstruct at the investigation stage. That design philosophy is consistent with an operator whose primary concern is not avoiding initial compromise detection but avoiding attribution and eviction once access has been established.

---

The C2 Node: China Unicom Backbone, Zero Detections, and a Certificate Observed One Day Before Expiry

The sole network-side indicator in this collection is 125.39.100.74, and it is analytically the most precisely characterised element of the dataset. The IP sits within the subnet 125.36.0.0/14, assigned by APNIC to Beijing Zhiyanghuanya Co., Ltd. under WHOIS netname ZHIYANGHUANYA-LTD-BJ, maintained by MAINT-CNCGROUP-TJ. The autonomous system is AS-4837 — CHINA UNICOM China169 Backbone — one of China's largest commercial ISP networks.

The choice of AS-4837 as C2 hosting fabric is itself a tradecraft signal. China Unicom's China169 backbone carries an enormous volume of legitimate commercial and residential traffic; routing operational C2 communications through it reduces the signal-to-noise ratio for network-based detection considerably. A security operations team observing outbound TLS connections to a China Unicom IP faces a much noisier baseline than it would against a dedicated offshore VPS provider with a thin legitimate-traffic profile. This is the "Terracotta VPN infrastructure use on Chinese commercial backbone" tradecraft signal the analyst has identified: blending operational traffic with legitimate Chinese ISP flows to degrade network-level detection confidence.

The TLS certificate on 125.39.100.74 provides the sharpest forensic hook in the dataset. Certificate serial 455c068601abe3da6879d80a90cedad4023 was issued by Let's Encrypt (issuer CN: R3) for the subject fox218.91iedu.cn. The validity window ran from 2021-02-25 to 2021-05-26 — a standard 90-day Let's Encrypt certificate lifecycle. CTX Team's telemetry recorded this certificate on 2021-05-25, one day before its expiry date. The analyst's reading of this observation is that the certificate was in active use at that point — the node was live and serving TLS connections under this identity the day before the certificate would have rotated. The 90-day Let's Encrypt window is itself a deliberate operational choice: automatically renewable, free, and short-lived, these certificates minimise the forensic longevity of any given TLS fingerprint. Once a certificate rotates, historical TLS-fingerprint-based hunting loses its anchor to that specific serial number, and investigators must pivot to other attributes — subject name patterns, issuer combinations, or IP-level associations — to maintain continuity.

The subject name fox218.91iedu.cn is worth examining. The domain pattern — a numeric subdomain under a .cn second-level domain — is consistent with the kind of infrastructure naming that blends into the background of Chinese internet hosting, where numeric subdomains under educational or commercial .cn domains are common. The "91iedu" component of the second-level domain could plausibly be read as an education-sector reference, which would provide additional camouflage for C2 traffic in environments where education-sector domains are not subject to the same scrutiny as known-bad TLDs or offshore registrars.

The detection posture of 125.39.100.74 is the most analytically striking observation in the collection: 0 detections across 91 VirusTotal engines, with a community reputation score of 0 and zero malicious votes. This is a named-actor C2 node — attributed to terracotta_vpn and Shell Crew in the threat feed — that the broader security community's detection infrastructure has not flagged. The analyst's outlier note offers two explanations: the IP may have aged out of active blocklists since its 2021 certificate observation, or its operational use may have been narrow enough to avoid community flagging in the first place. Both explanations are consistent with the campaign's documented indicator-suppression discipline. A C2 node that generates minimal traffic, serves a small number of implants, and rotates its TLS identity on a 90-day cycle is precisely the kind of infrastructure that evades community-sourced detection — it never generates the volume of malicious traffic reports that would push it into blocklist territory.

There is also a data-freshness question worth surfacing explicitly. The certificate observation date is 2021-05-25, but the campaign window in CTX Team's telemetry runs from January to June 2026 — a gap of approximately five years. This raises the possibility that 125.39.100.74 represents aged infrastructure that was reactivated for this operation, or that the 2021 certificate artefact is a historical anchor for a node that has since rotated its TLS identity and may now present a different certificate to connections. Analysts hunting for successor infrastructure on AS-4837 subnets should treat the fox218.91iedu.cn subject pattern as a historical reference point rather than a current fingerprint, and should prioritise hunting for the T1070 indicator-removal behaviour cluster as the more durable detection surface.

---

The Attack Chain: From Masquerading Entry to Credential Harvest and Destructive Contingency

Walking the analyst's attack mechanism chain in sequence reveals a campaign that is operationally coherent from entry to impact, even where individual stages rest on inferred rather than directly observed evidence.

The chain opens with defense evasion before execution — an ordering that distinguishes this toolset from commodity malware, which typically executes first and evades second. The masquerading techniques [T1036, T1036.001, T1036.007] are the entry-point mechanism: the files present as legitimate binaries or carry superficially valid signatures, allowing them to pass initial endpoint inspection. The "hacktool" classification suggests these are not generic commodity tools but purpose-built offensive utilities, likely tailored for the specific operational context of the Mexico construction-sector intrusion.

Execution proceeds via direct Windows Native API calls [T1106] and Windows service installation [T1569.002]. The Native API execution path is significant: rather than relying on higher-level Windows APIs that are more commonly monitored by endpoint detection products, the toolset interacts directly with the Windows kernel interface. This reduces the visibility of execution to security products that instrument higher-level API layers. Service-based execution [T1569.002] provides a reliable invocation mechanism — services can be started automatically, restarted on failure, and run under system-level privileges without requiring user interaction.

Persistence is established through Windows service creation [T1543.003] combined with registry modification [T1112]. The service registration ensures the implant survives reboots; the registry modification — likely targeting run keys or service configuration entries — provides an additional persistence anchor and may also be used to store configuration data or obfuscate the implant's presence within the registry hive. File and directory permission modifications [T1222, T1222.001] are used to access protected data stores, potentially including credential material stored in protected locations.

The credential-access stage involves OS credential dumping [T1003, T1003.002], indicating the operator is harvesting account credentials from the compromised host — likely from LSASS memory or Security Account Manager (SAM) database dumps. Combined with registry querying [T1012] and process discovery [T1057], this gives the operator a comprehensive picture of the target environment: what accounts exist, what processes are running, what software is installed, and what credentials can be harvested for lateral movement.

Command and control is established over TLS to 125.39.100.74 on AS-4837, using the fox218.91iedu.cn certificate as TLS cover [T1573]. The encrypted channel makes traffic content inspection difficult without TLS interception capability; the China Unicom backbone hosting provides the network-level camouflage discussed above. The implant also carries debugger detection capability [T1622] and impairment of defenses [T1562, T1562.001] — suggesting it actively checks for and disables security tooling on the host, complementing the sandbox evasion performed before initial execution.

The final stage of the chain — and the one that most distinguishes this campaign from a standard espionage collection operation — is the presence of data destruction [T1485] and service-stop [T1489] capabilities in the MITRE tag set. Data destruction, as defined in the ATT&CK framework, involves overwriting or deleting files in ways that render them irrecoverable by forensic methods — distinct from the file deletion used for indicator removal, which targets the attacker's own artefacts. Service stop involves disabling critical system services, potentially rendering systems unavailable to legitimate users. The presence of both capabilities alongside an espionage motivation tag is the operationally notable combination in this dataset: it suggests the operator either deploys a modular toolkit where destructive modules are available on demand, or that this specific intrusion set was configured for a higher-impact contingency. Whether these capabilities were exercised in the Mexico construction-sector intrusion is not evidenced in the current reporting — their presence in the MITRE tag metadata indicates capability, not confirmed execution.

The hidden-files-and-directories technique [T1564, T1564.004] rounds out the picture: the toolset uses NTFS alternate data streams or other hiding mechanisms to conceal files from standard directory enumeration, adding another layer of persistence concealment on top of the timestamp manipulation and event-log clearing.

---

The terracotta_vpn Family and the Modular Toolkit Profile

The terracotta_vpn family is the sole named malware family in this collection, and its presence on a China Unicom backbone node is consistent with its documented role as a VPN-layer tool used to route and obscure operational traffic through Chinese commercial ISP infrastructure. The family name itself is descriptive: "terracotta" is a label applied by the research community to a class of VPN infrastructure associated with Chinese state-aligned actors, characterised by its use of legitimate Chinese commercial hosting to blend operational traffic with civilian internet flows.

What the MITRE tag set associated with the five file IOCs describes, however, is considerably more than a VPN routing layer. The technique coverage spans masquerading and invalid signing at the entry point, native API and service-based execution, service and registry persistence, credential dumping and registry querying for collection, sandbox and debugger evasion, a full indicator-removal suite, and destructive impact capabilities. This is the profile of a capable, multi-stage implant or toolkit rather than a single-function VPN relay — suggesting that "terracotta_vpn" in this context may refer to the infrastructure-routing component of a broader toolchain, with the file-side components providing the full intrusion capability set.

The absence of any file metadata for the five SHA256s is a significant analytical constraint that must be stated plainly:

• d25f2a3ad409ad215d6d18bf11b6e40ecfd8290af296fff966e1a086f81da696
• 740d53fda46970c4cf2907581cbb6c142d89fe72a1bf40fff0d16406a886b6d6
• e1155b5f625652bf4559576a342ef1a65635e667465bbdec4fd0f12413b72897
• 9355839bce58c285209ffc9b0f4aea0e62bdac9c90df58a580982f54cc44ec71
• e4f317b8120d219cd7e3d9453bde1129864677df8c7f059b81813b3756438d7c

None of these hashes has been submitted to VirusTotal, or if submitted, no enrichment data has been returned. This is itself potentially informative: files that have never been submitted to community scanning platforms are either very new, very narrowly distributed, or deliberately kept off public analysis infrastructure. For a campaign attributed to a state-aligned actor with documented operational-security discipline, the third explanation is plausible — the operator may deliberately avoid submitting tooling to public sandboxes or sharing it in contexts where it would reach community scanning. The practical consequence for this analysis is that all behavioural claims about the file components rest on threat-feed MITRE tag metadata, and the confidence level on those claims is medium at best.

The modular capability profile — espionage collection tools paired with destructive contingency capabilities — is consistent with what public reporting has long associated with sophisticated state-aligned Chinese intrusion sets: a primary mandate of intelligence collection, with destructive or disruptive capabilities held in reserve for contingencies. The specific combination of T1485 (data destruction) and T1489 (service stop) alongside credential dumping and lateral movement suggests an operator who has thought through multiple operational scenarios and pre-positioned accordingly. Whether the Mexico construction-sector intrusion represents a targeted collection operation, a capability pre-positioning exercise, or something in between cannot be determined from the current evidence.

---

Shell Crew's Interest in Mexico's Construction Sector

Shell Crew — tracked under a wide range of aliases including Deep Panda, APT26, Turbine Panda, Bronze Express, Checkered Typhoon, and Taffeta Typhoon — is attributed in the threat feed as a Chinese state-aligned actor with an espionage motivation. The campaign's targeting of Mexico's construction sector, with a regional focus on Mexico (MX), suggests an intelligence-collection interest in infrastructure development, contracting networks, or supply-chain access rather than financial gain.

The actor's use of Chinese commercial backbone infrastructure for C2 routing — specifically AS-4837, China Unicom's China169 Backbone — is consistent with the "Terracotta VPN infrastructure use on Chinese commercial backbone" tradecraft signal identified for this campaign. Routing operational traffic through a major Chinese commercial ISP rather than offshore VPS infrastructure is a deliberate choice that trades some operational flexibility for significantly improved network-level camouflage.

No widely-reported prior campaign with confident attribution to Shell Crew specifically targeting Mexico's construction sector comes to mind from the available evidence base; the historical arc for this specific targeting combination is not established in available reporting. The campaign's five-month observation window (January–June 2026) and the data-freshness question around the 2021 certificate artefact both suggest this may represent either a new operational focus or a reactivation of infrastructure from an earlier operation — but the evidence to distinguish between those possibilities is not available.

---

What the Evasion Architecture Signals About Operational Maturity

The most operationally significant signal in this dataset is not the actor identity, the targeting geography, or even the specific tools deployed — it is the evasion architecture and what it reveals about the operator's operational-security posture and priorities.

A C2 node that scores zero detections across 91 engines despite active attribution to a named actor and a named malware family is not an accident. It is the outcome of deliberate infrastructure choices: a major commercial ISP backbone that provides network-level camouflage, a short-lived TLS certificate that limits the forensic window for certificate-based hunting, and operational use narrow enough to avoid generating the community-flagging volume that would push the IP into blocklist territory. The 90-day Let's Encrypt certificate cycling is particularly telling — it is the minimum viable forensic footprint for a TLS-secured C2 channel, and it is automated, meaning the operator incurs essentially no operational overhead to maintain it. Once the certificate rotates, the specific serial number 455c068601abe3da6879d80a90cedad4023 becomes a historical artefact rather than a live hunting anchor.

The file-side evasion discipline tells a parallel story. Time-based sandbox evasion [T1497.003] before execution, combined with a full T1070 indicator-removal suite during and after execution, describes a toolset that has been designed with the assumption that it will eventually be encountered by security researchers — and that the goal is not to be undetectable in principle but to ensure that by the time detection occurs, the forensic trail has been sufficiently degraded to prevent reconstruction of the full intrusion. Event-log clearing [T1070.001] removes the audit trail. File deletion [T1070.004] eliminates dropped components. Timestomping [T1070.006] disrupts timeline analysis. Together, these three sub-techniques target the three primary forensic reconstruction methods available to incident responders: log analysis, artefact recovery, and timeline correlation.

The presence of data destruction [T1485] and service-stop [T1489] capabilities alongside this anti-forensic discipline raises a question about the operator's escalation calculus. An espionage-motivated actor that has pre-positioned destructive capabilities is signalling that it has considered scenarios beyond passive collection — scenarios where the value of disrupting the target outweighs the value of maintaining persistent access, or where destroying evidence of the intrusion is operationally preferable to allowing forensic reconstruction. The Mexico construction sector, as a target, is not an obvious candidate for disruptive action in the way that critical infrastructure or government systems might be — which makes the presence of these capabilities more interesting, not less. It suggests either that the operator deploys a standardised toolkit regardless of target type, or that the construction-sector intrusion is part of a broader operation where disruptive contingencies are genuinely on the table.

The data-freshness question around the 2021 certificate observation against a 2026 campaign window is worth holding as an open analytical thread. If 125.39.100.74 represents infrastructure that was active in mid-2021 and has been reactivated or maintained through 2026, that speaks to an operator with a long-horizon infrastructure management approach — nodes are not burned after a single operation but are maintained, rotated in and out of active use, and redeployed as needed. If the 2021 certificate is a historical anchor for a node that has since rotated its TLS identity, then the current operational certificate for this C2 node is unknown, and the fox218.91iedu.cn subject pattern is a historical reference rather than a current fingerprint.

Either way, the picture that emerges is of an operator who has invested significantly in operational longevity — in infrastructure that blends in, certificates that rotate before they can be widely fingerprinted, and tools that clean up after themselves. The zero-detection posture of the C2 node, read against the backdrop of a five-month active campaign window and a documented indicator-suppression discipline, is less a gap in the security community's detection coverage and more a measure of how effectively that discipline has worked. The construction sector organisations in Mexico that were in the crosshairs of this operation faced an adversary whose primary investment was not in getting in — it was in staying in, and in making sure that when they eventually left, they left as little trace as possible.