Daggerfly

DaggerFly, also known as Evasive Panda and StormBamboo, is a Chinese-speaking Advanced Persistent Threat (APT) group that has been active since at least 2012. The group is renowned for its use of the custom MgBot malware framework, which it leverages to conduct cyberespionage activities against individuals and organizations in mainland China, Hong Kong, Macao, Nigeria, and other regions. In addition to this, DaggerFly and several other Chinese intrusion sets, such as APT41, Mustang Panda, Tonto Team, and Dark Pink, have been increasingly utilizing a technique called DLL side-loading to load their malware onto targeted machines. In a notable instance between November 2022 and April 2023, DaggerFly conducted a cyber espionage campaign against an African telecommunications organization. This campaign was identified by Symantec, who noted the use of new MgBot plugins during the intrusion. Additionally, Volexity researchers discovered an attack by DaggerFly in mid-2023, where they detected multiple systems becoming infected with malware. The group had successfully compromised an undisclosed Internet Service Provider (ISP) to poison DNS responses for target organizations. DaggerFly's capabilities extend beyond these activities, with evidence pointing towards the ability to Trojanize Android APKs, intercept SMS and DNS requests, and target Solaris OS. The group's resilience is demonstrated by its capacity to quickly update its toolset in response to exposure, ensuring minimal disruption to its espionage activities. Furthermore, DaggerFly's arsenal includes various malware, such as Macma and Mgbot, all of which contain code from a shared library or framework, indicating a sophisticated and coordinated operation.