Ink Dragon uses a multi-stage attack chain exploiting vulnerable internet-exposed web applications to drop web shells, then deploys ShadowPad and FINALDRAFT malware. They exploit predictable ASP.NET machine key values for ViewState deserialization attacks against IIS and SharePoint servers, installing custom ShadowPad IIS Listener modules to create proxy networks. The group weaponizes ToolShell SharePoint flaws, uses RDP tunnels for lateral movement, dumps LSASS for privilege escalation, and modifies firewall rules. FINALDRAFT implements a modular command framework using encoded documents in victim mailboxes, while the group creates a relay network where compromised hosts become infrastructure nodes.