Evasive Panda’s Malicious Campaign Exploits Software Update Channels

Evasive Panda’s malicious campaign uses the update channels of legitimate Chinese applications to deliver their infamous backdoor, MgBot malware, to unsuspecting victims.

Researchers at ESET have recently uncovered a new cyber attack campaign linked to the notorious APT group Evasive Panda.

The team’s trademark is the use of the custom MgBot modular malware framework, which is able to receive addons components on the move to expand its intelligence-gathering capabilities.

Know about Evasive Panda?

Evasive Panda (also known as BRONZE HIGHLAND and Daggerfly) is a Chinese-speaking APT group actively targeting individuals and government entities across multiple countries since at least 2012.Their previous targets include China, Macao, Nigeria, and Southeast and East Asian countries.

The latest Evasive Panda’s malicious campaign mostly concentrated in the Gansu, Guangdong, and Jiangsu provinces of China, focusing on members of an international NGO operating within two of these provinces.

However, it points to one of two scenarios, a supply chain compromise of Tencent QQ’s update servers or an adversary-in-the-middle case , as reported by Kaspersky in June 2022, involving a Chinese hacking crew named LuoYu.

According to the report, the malware used by Daggerfly in the recent campaign is highly sophisticated and difficult to detect.

IOCS

Follow Us on: Twitter, Instagram, Facebook to get the latest security news!