Bronze Highland

Bronze Highland, also known as Evasive Panda and Daggerfly, is a Chinese-speaking advanced persistent threat (APT) group that has been active since at least 2012. The group conducts cyberespionage against individuals in mainland China, Hong Kong, Macao, and Nigeria, along with specific organizations within China and Hong Kong. According to ESET Research, the group uses custom malware like MgBot to spy on its victims and collect data from their devices. In March 2024, Bronze Highland initiated a global campaign targeting Tibetans, as reported by Hackread and Antivirus and Internet Security Solutions provider ESET. The group has also been observed using new iterations of Macma malware, which includes improved screen capture functionality and new logic to collect a file's system listing. This sophisticated cyber-espionage campaign illustrates the group's ongoing evolution and capability to target diverse groups across various countries and territories. Furthermore, in April 2023, the group was reported to have targeted African telecommunications providers, demonstrating their expansive reach beyond Asia. Historically, the group has targeted not only individuals but also government entities in mainland China, India, Hong Kong, Macao, Malaysia, Myanmar, the Philippines, Nigeria, Taiwan, and Vietnam. This wide range of targets indicates the scale and potential impact of Bronze Highland's activities.