Daggerfly

DaggerFly, also known as Evasive Panda and StormBamboo, is a Chinese-speaking Advanced Persistent Threat (APT) group that has been active since at least 2012. The group is recognized for its cyber espionage activities against individuals and organizations in mainland China, Hong Kong, Macao, Nigeria, and other regions opposing China's interests. DaggerFly, along with several other Chinese intrusion sets such as APT41, Mustang Panda, Tonto Team, and Dark Pink, have increasingly employed a technique known as DLL side-loading to load their malware onto targeted machines. From November 2022 to April 2023, DaggerFly conducted a significant cyber espionage campaign against an African telecommunications organization. This campaign was similar to the SoftCell campaign led by Gallium (aka Alloy Taurus), which targeted telecommunication entities in the Middle East. In 2023, Symantec identified a new intrusion by DaggerFly at an African telecom operator, where the threat actor used new plugins from its custom MgBot malware framework. DaggerFly's decade-long activity and persistent use of the MgBot framework highlight its sustained threat to global cybersecurity. In August 2024, Volexity researchers reported that DaggerFly successfully compromised an undisclosed internet service provider (ISP). The group used this breach to poison DNS responses for target organizations, demonstrating a sophisticated approach to exploiting software vendor update mechanisms. This method of attack aligns with DaggerFly's broader strategy of targeting ISPs as launchpads for their operations, further emphasizing the need for robust security measures across all levels of digital infrastructure.