Bronze Highland

Bronze Highland, also known as Evasive Panda and Daggerfly, is a China-linked Advanced Persistent Threat (APT) group that has been active since at least 2012. The group primarily conducts cyber espionage against individuals in mainland China, Hong Kong, Macao, and Nigeria, as well as certain organizations within China and Hong Kong. It also targets countries and organizations opposing China's interests through independence movements, such as those in the Tibetan diaspora, religious and academic institutions in Taiwan and Hong Kong, and supporters of democracy in China. The APT group has recently upgraded its malware arsenal significantly, introducing new versions of its malware, most likely in response to exposure of older variants. These updates include a new malware family based on the MgBot framework and an updated version of the macOS backdoor Macma. The new iterations of Macma include improved screen capture functionality and new logic to collect a file's system listing. This new toolset was deployed in a number of recent attacks against organizations in Taiwan and a U.S. NGO based in China, indicating the group's engagement in internal espionage. Recently, a sophisticated cyber-espionage campaign by Bronze Highland has been observed targeting Tibetans across various countries and territories. The campaign represents a global expansion of the group's activities, demonstrating its growing threat to cybersecurity worldwide. Given the group's persistent activity and evolving tactics, it remains a significant concern for cybersecurity professionals and organizations alike.