ChinaAssessedPRC-linkedEspionageActive 2012 – 2024Daggerfly
Also known asEvasive Panda · BRONZE HIGHLAND · StormBamboo · StormCloud · Digging Taurus
Summary
PRC-linked espionage actor (MITRE G1034; Symantec Daggerfly, ESET/Kaspersky Evasive Panda, Volexity StormBamboo) active since at least 2012 and the exclusive user of the MgBot framework, with Nightdoor and the macOS MACMA backdoor. Signature tradecraft is subverting software updates: Volexity saw it poison DNS at an ISP in mid-2023 to push malicious updates; Kaspersky documented DNS-poisoning / adversary-in-the-middle delivery of MgBot through hijacked updates of SohuVA, iQIYI, IObit Smart Defrag and Tencent QQ from Nov 2022 to Nov 2024 against victims in Türkiye, China and India. ESET's Monlam operation (from Sep 2023) combined a watering hole on a Tibetan festival site with a trojanized Tibetan-language software supply chain.
Attribution
No service publicly named
Assessed by security researchers or MITRE ATT&CK; no government attribution on record.
- MITRE ATT&CK (MITRE ATT&CK, 2026-10)
PRC-linked APT - ESET Research (Research, 2024-03-07)
China-aligned Evasive Panda
Campaigns 3
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| Monlam festival watering hole and Tibetan-language software supply chain (MgBot, Nightdoor) | 2023-09 – 2024-01 | India, Taiwan, Hong Kong, Australia, USA | Religious, Individuals | ESET Research (2024-03-07) |
| ISP-level DNS poisoning to abuse insecure software-update mechanisms | 2023 | Global | ISP customers | Volexity (2024-08-02) |
| DNS poisoning / AitM of software updates delivering MgBot (SohuVA, iQIYI, IObit, Tencent QQ) | 2022-11 – 2024-11 | Turkey, China, India | Multiple | Kaspersky GReAT (2025-12-24) |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 6
| Resource Development2 | T1587.002Code Signing CertificatesT1584.004Server |
|---|---|
| Initial Access2 | T1195.002Compromise Software Supply ChainT1189Drive-by Compromise |
| Stealth1 | T1036.003Rename Legitimate Utilities |
| Credential Access1 | T1557Adversary-in-the-Middle |
Malware and tools 3
| Name | Description | Platform |
|---|---|---|
| MgBot | Modular backdoor framework (exclusive) | Windows |
| Nightdoor | Backdoor | Windows |
| MACMA | Backdoor | macOS |
Infrastructure patterns
- DNS poisoning inside a compromised ISP redirects software updates to its server (Volexity, 2024)
- Google Drive as C&C for Nightdoor; compromised servers as watering holes and C&C (ESET, 2024)