APT41: ShadowPad via Signed-Binary Side-Loading

A China-nexus espionage actor exploited an internet-facing IIS research portal, side-loaded the ShadowPad backdoor through a legitimate signed binary, dumped LSASS for a domain administrator credential, and ran Cobalt Strike command and control over HTTPS. Reconstruct the intrusion from SIEM, endpoint XDR, and perimeter firewall telemetry, and classify the key ATT&CK techniques.