Daggerfly

DaggerFly, also known as Evasive Panda and Bronze Highland, is a Chinese-speaking Advanced Persistent Threat (APT) group that has been active since 2012. The group is known for its cyberespionage activities targeting individuals in mainland China, Hong Kong, Macao, and Nigeria. In addition to these regions, DaggerFly has also targeted specific organizations within China and Hong Kong. The group is part of a larger set of Chinese intrusion sets, including APT41, Mustang Panda, Tonto Team, and Dark Pink, which have increasingly used DLL side-loading techniques to load their malware onto targeted machines. Between November 2022 and April 2023, DaggerFly conducted a significant cyber espionage campaign against an African telecommunications organization. This attack was similar to the one carried out by Gallium (also known as Alloy Taurus), another intrusion set sharing similarities with APT10 and APT41, which targeted telecommunication entities in the Middle East during the SoftCell campaign. DaggerFly's attacks were identified through their use of unique tools such as the MgBot modular malware framework and a new Windows backdoor, dubbed Trojan.Suzafk or Nightdoor, first identified by Eset researchers. In recent years, DaggerFly has expanded its reach, launching a global cyberespionage campaign targeting Tibetans. This was reported in March 2024 by hackread.com, citing Antivirus and Internet Security Solutions provider ESET. The group is also likely behind the previously unattributed Macma backdoor loaded onto iPhone and macOS devices. Symantec has tracked DaggerFly's activities closely, linking them to several significant incidents, including the 2021 Hong Kong Waterhole Attacks and attacks on a telecommunications organization in Africa during 2023.